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Abstract 


The  United  States  military,  and  in  particular  the  Air  Force,  has  long  recognized 
the  requirement  for  a  responsive  spacelift  capability  as  an  enabler  to  gaining  and 
maintaining  space  superiority.  In  order  to  fulfill  this  requirement,  the  Air  Force  as  a 
portion  of  its  Operationally  Responsive  Space  initiative  is  considering  the  design  and 
development  of  a  reusable  military  launch  vehicle  (RMLV)  to  provide  more  responsive 
spacelift  than  the  current  spacelift  systems  provide.  The  design  of  both  the  RMLV  and 
the  supporting  ground  processes  will  determine  whether  the  Air  Force  can  successfully 
achieve  its  performance  goals  for  the  RMLV.  The  purpose  of  this  research  was  to 
develop  a  discrete-event  computer  simulation  model  of  the  post-landing  vehicle  recovery 
operations  to  allow  the  Air  Force  Research  Laboratory,  Air  Vehicles  Directorate  to 
evaluate  design  and  process  decisions  and  their  impact  on  RMLV  regeneration  time  in 
the  early  phases  of  the  acquisition  process. 

The  model  is  based  primarily  on  the  post-landing  vehicle  recovery  process  for  the 
only  reusable  space  vehicle  in  the  world,  the  Space  Shuttle  Orbiter.  However,  it  does 
contain  some  elements  from  the  aircraft  recovery  process  for  the  F-16  fighter  aircraft. 

The  model  was  analyzed  and  validated  by  a  panel  of  experts  in  the  fields  of  Space  Shuttle 
Orbiter  and  F-16  aircraft  post-landing  recovery.  The  model  was  verified  using  an 
assertion  checking  method.  In  addition  to  the  model,  conclusions  are  drawn  regarding 
several  design  decision  based  on  a  comparison  of  the  Space  Shuttle  orbiter  and  F-16  post¬ 
landing  recovery  operations.  No  experiments  to  evaluate  design  alternatives  were 
conducted  as  a  part  of  this  research. 
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A  DISCRETE-EVENT  SIMUEATION  MODEL  EOR  EVALUATING  AIR  FORCE 


REUSABLE  MILITARY  LAUNCH  VEHICLE  POST-LANDING  OPERATIONS 


I.  Introduction 


Background 

The  United  States  eurrently  enjoys  the  considerable  advantage  of  owning  and 
operating  the  best  military  space  capabilities  in  the  world.  Capabilities  such  as  secure 
global  communications  provided  by  our  military  and  commercial  communications 
satellites,  and  precise  navigation  and  timing  available  from  the  Global  Positioning 
System  (GPS),  have  allowed  the  Air  Force  and  the  entire  Department  of  Defense  (DoD) 
to  fundamentally  change  the  way  America  fights  wars.  The  advantages  gained  from 
these  and  other  space  capabilities  are  so  profound  that  the  Air  Force  has  had  to  develop 
the  new  doctrinal  concepts  of  space  superiority  and  space  supremacy.  Gaining  space 
superiority  is  a  critical  step  in  any  military  operation,  and  provides  sufficient  control  of 
space  in  ensure  freedom  of  action  for  friendly  forces,  to  include  the  freedom  to  attack  as 
well  as  the  freedom  from  attack  (AFDDl  :76).  Space  superiority  provides  the  degree  of 
dominance  to  “permit  friendly. .  .space  forces  to  operate  at  a  given  time  and  place  without 
prohibitive  interference  by  the  opposing  force”  (AFDDl ;77).  Space  supremacy  goes  a 
step  further,  providing  the  “degree  of  superiority  wherein  the  opposing...  space  forces  are 
incapable  of  effective  interference  anywhere  in  a  given  theater  of  operations” 

(AFDDl  :77).  Like  air  and  land  superiority,  space  superiority  is  a  critical  element  of  the 
American  way  of  war. 
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There  are  several  capabilities  that  are  required  to  deliver  the  effects  needed  to 
ensure  space  superiority,  including  timely  and  responsive  spacelift.  Air  Force  spacelift 
objectives  are  to  “deploy  new  and  replenish  space  assets  as  necessary  to  meet  US  space 
goals  and  achieve  national  security  objectives”  (AFDD1:52).  In  meeting  these 
objectives,  the  Air  Force  must  provide  spacelift  capabilities  that  are  functional  and 
flexible,  capable  of  meeting  a  full  range  of  national  security  requirements,  in  a  manner 
that  is  timely  and  responsive  to  the  user’s  needs  (AFDD1;52).  In  simplest  terms,  the  Air 
Force’s  spacelift  capabilities  must  be  able  to  reliably  deliver  a  broad  variety  of 
capabilities  to  orbit  in  a  timely  and  responsive  manner.  If  the  Air  Force’s  spacelift 
system  cannot  deliver  a  variety  of  different  satellites,  with  varying  capabilities,  to  space 
when  they  are  required,  the  Air  Force  will  not  be  able  to  meet  its  spacelift  mission 
requirements. 

Current  expendable  launch  systems,  while  reliable,  are  not  responsive,  often 
taking  weeks  to  months  to  prepare  for  launch  (Isakowitz  et  al,  2004:496).  To  provide  a 
more  responsive  launch  system,  at  a  lower  cost,  the  Air  Force  is  conducting  research  to 
develop  a  reusable  military  launch  vehicle  (RMLV)  within  the  construct  of  Air  Force 
Space  Command’s  concept  for  Operationally  Responsive  Space  (ORS),  a  subset  of  which 
is  Operationally  Responsive  Spacelift  (Stewart,  2003). 

The  National  Aeronautics  and  Space  Administration’s  (NASA)  Space  Shuttle  is 
the  only  reusable  space  launch  vehicle  currently  in  use  worldwide.  Researching  the 
design,  methods,  and  processes  for  operating  and  maintaining  the  Space  Shuttle  Orbiter 
provides  a  baseline  for  the  RMLV,  but  it  is  not  a  perfect  match.  The  Space  Shuttle,  while 
accomplishing  impressive  feats,  never  met  its  operational  performance  goals  for  the 


2 


number  of  expects  flights  per  year.  A  major  factor  in  the  failure  to  reach  its  goals  was  the 
complexity  and  duration  of  the  ground  operations  required  to  recover  the  orbiter  and 
prepare  it  for  its  next  mission  (McCleskey,  2005:2-3).  In  its  root  cause  analysis  to 
determine  areas  for  technical  process  improvement,  NASA  identified  numerous  causes 
for  the  length  of  the  vehicle  turnaround  time.  Most  of  these  causes  were  the  result  of  the 
systems  design  features,  such  as:  the  use  of  hazardous  fuels  and  pyrotechnics  that  require 
special  handling  to  protect  personnel,  complex  maintenance  processes  that  could 
potentially  be  simpler  with  a  different  vehicle  design,  and  maintenance  processes  that 
required  additional  work  simply  to  access  the  item  due  to  structural  design  (McCleskey, 
2005:77-1 19).  The  Space  Shuttle  as  a  system  has  been  reliable,  but  it  has  not  provided 
the  responsiveness  and  performance  it  was  intended  to  in  its  original  conception. 

The  implication  of  the  performance  limitations  of  the  expendable  launch  systems, 
and  the  only  reusable  launch  system  for  the  RMLV  designers  is  clear:  RMLV  designers 
must  learn  from  the  experiences  of  past  space  launch  systems,  and  apply  the  lessons  to 
the  RMLV’s  design  to  ensure  it  can  meet  the  performance  goals  defined  by  the  Air  Force. 
This  is  not  an  easy  task.  The  RMLV  designers  will  have  to  fully  understand  the  reasons 
for  the  performance  limitations  of  the  other  space  launch  systems  and  avoid  design 
decisions  that  have  limited  their  responsiveness,  while  maintaining  a  reliable  system  that 
builds  on  current  technologies. 

The  research  presented  in  this  paper  is  part  of  an  effort  to  help  inform  the  RMLV 
designers  as  to  the  implications  of  various  vehicle  design  decisions  through  the 
application  of  a  discrete-event  computer  simulation  model  for  the  RMLV  post-landing 
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recovery  operations,  in  the  context  of  Air  Force  doctrine  and  goals  of  a  highly  reliable 
and  responsive  spacelift  capability. 

Problem 

The  primary  challenge  the  Air  Force  faces  regarding  the  RMLV  is 
responsiveness.  RMLV  regeneration  time  must  be  short  enough  to  provide  that 
responsiveness.  The  regeneration  process  consists  of  three  basic  phases:  post-landing 
vehicle  recovery,  maintenance,  and  prelaunch  operations.  The  first  of  these  three  phases 
includes  actions  to  make  the  vehicle  safe  for  ground  crews  to  operate  near  the  vehicle, 
safety  assessments  to  detect  hazardous  conditions,  actions  to  protect  the  vehicle  during 
movements,  and  actions  to  make  the  vehicle  safe  to  put  into  the  maintenance  facility. 

This  phase  is  the  shortest  of  the  three  phases  of  vehicle  regeneration,  but  is  critical  to 
ensuring  safe  and  timely  maintenance  can  be  performed  on  the  RMLV  to  prepare  it  for  its 
next  mission.  Capt  Ty  Pope  addressed  the  vehicle  maintenance  portion  of  the  RMLV 
regeneration  process  in  his  thesis  from  the  Air  Force  Institute  of  Technology,  and  Capt 
Adam  Stiegelmeier  addressed  RMLV  prelaunch  operations  in  his  thesis  from  the  same 
institution  (Pope,  2006/Stiegelmeier,  2006).  The  models  that  resulted  from  their  research 
were  comvined  into  onne  model  call  MILePOST.  The  model  product  from  this  research 
will  e  added  to  MILePOST  to  offer  a  complete  regeneration  model  for  AFRLA^A 
researchers.  With  respect  to  time,  the  post-landing  vehicle  recovery  process  is  much 
shorter  and  less  complex  than  the  other  phases,  but  is  equally  impacted  by  major  vehicle 
and  system  design  decisions  that  will  determine  whether  the  Air  Force  can  reach  its 
regeneration  performance  goals  for  the  RMLV. 
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Research  Objective 

The  purpose  of  this  research  is  to  aid  the  Air  Force  in  the  effort  to  determine  the 
most  effective  post-landing  vehicle  recovery  process  based  on  vehicle  and  system  design 
decisions  by  creating  a  discrete-event  simulation  model  of  a  generic  RMLV  post-landing 
vehicle  recovery  process.  This  model  can  help  decision  makers  evaluate  vehicle  and 
system  design  tradeoffs  to  develop  the  most  effective  RMLV  system  to  support  Air 
Force’s  spacelift  requirements.  It  can  also  identify  portions  of  the  vehicle  recovery 
process  that  are  the  most  sensitive,  with  regard  to  time,  to  design  decisions.  To  guide  the 
research,  the  following  research  question  is  proposed: 

How  can  the  Air  Force  develop  a  discrete-event  computer  simulation  model  of 

RMLV  post-landing  vehicle  recovery  operations  that  will  aid  decision  makers  in 

evaluating  RMLV  and  system  design  alternatives? 

The  research  question  is  divided  into  the  following  investigative  questions: 

1 .  What  generic  functions,  or  sequence  of  actions,  describe  RMLV  post-landing 
vehicle  recovery  operations? 

2.  How  do  these  RMLV  post-landing  vehicle  recovery  operations  functions 
compare  to  space  shuttle  orbiter  and  aircraft  post-landing  recovery  operations? 

3.  What  are  the  RMLV  design  drivers  that  will  influence  RMLV  post-landing 
vehicle  recovery  operations,  and  how  will  these  affect  the  number,  type,  and 
duration  of  RMLV  post-landing  vehicle  recovery  operations  activities? 

4.  How  can  these  RMLV  design  drivers  and  post-landing  vehicle  recovery 
operations  activities  be  incorporated  into  a  discrete-event  simulation  model 
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that  captures  a  baseline  RMLV  post-landing  vehiele  reeovery  operations 
sequenee? 

5.  What  RMLV  regeneration  timeline  insights  ean  be  gained  from  running  the 
model  using  notional  but  plausible  inputs? 

Summary  and  Preview 

This  ehapter  provided  a  general  overview  of  the  doetrinally  driven  need  for  a 
responsive  and  timely  spacelift  eapability  within  the  Air  Foree.  The  purpose  for  the 
research  was  identified  with  a  researeh  overview  in  the  form  of  a  researeh  question  and 
investigative  questions.  Chapter  II  will  provide  an  overview  of  the  Air  Foree ’s  future 
goals  for  spacelift  in  the  context  of  national  poliey,  general  post-landing  vehicle  reeovery 
proeesses  from  the  Spaee  Shuttle  orbiter  and  the  F-16  fighter  aireraft,  and  s  eomparison 
of  the  attributes  of  both  proeesses.  Chapter  III  will  deseribe  the  methodology  used  in  this 
research.  Chapter  IV  will  include  a  description  of  the  model  developed  for  this  research, 
as  well  as  the  model  verifieation  and  validation  proeesses  and  their  results.  Chapter  V 
will  offer  research  conclusions  and  recommendations  for  future  researeh  to  expand  and 
improve  upon  this  researeh. 
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II. 


Literature  Review 


Introduction 

This  chapter  will  provide  the  background  used  for  developing  the  RMLV  post¬ 
landing  vehiele  reeovery  diserete-event  eomputer  simulation  model.  The  baekground  for 
understanding  how  this  researeh  fits  within  the  broader  eontext  is  provided  in  three  parts. 
First,  understanding  the  Air  Foree’s  future  spacelift  objeetives  will  place  the  RMLV  and 
the  importanee  of  designing  the  optimum  system  and  proeesses  into  the  appropriate 
context.  Second,  the  post-landing  vehicle  reeovery  proeesses  for  the  F-16  and  Spaee 
Shuttle  orb  iter  and  F-16  fighter  aireraft  provide  the  basis  for  the  model’s  construct,  so 
these  processes  are  summarized  in  this  chapter.  Third,  the  orbiter  and  F-16  proeesses  are 
compared  to  highlight  design  and  process  differences  that  impact  the  design  and  process 
decisions  for  the  RMLV. 

Future  Air  Force  Spacelift  Objectives 

The  Air  Foree’s  goals  regarding  spacelift  can  be  viewed  in  the  context  of  U.  S. 
Spaee  Transportation  policy,  and  are  articulated  through  the  eoneept  ealled  Operationally 
Responsive  Space  (ORS).  The  primary  goal  of  US  Spaee  Transportation  policy  is  “to 
ensure  the  capability  to  acess  and  use  spaee  in  support  of  national  and  homeland  security, 
civil,  scientific,  and  economic  interests”  (US  Space  Transportation  Policy,  2005:2).  The 
first  two  objectives  supporting  this  goal  are  as  follows: 
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1.  “Ensure  the  availability  of  U.S.  spaee  transportation  eapabilities  neeessary  to 
provide  reliable  and  affordable  spaee  aeeess,  ineluding  aeeess  to,  transportation 
through,  and  return  from  spaee; 

2.  Demonstrate  an  initial  eapability  for  operationally  responsive  aeeess  to  and  use 
of  spaee  -  providing  eapaeity  to  respond  to  unexpeeted  loss  or  degradation  of 
seleeted  eapabilities,  and/or  to  provide  timely  availability  of  tailored  or  new 
eapabilities  -  to  support  national  seeurity  requirements”  (US  Spaee 
Transportation  Poliey,  2005:2) 

The  Air  Foree  is  leading  the  joint  Department  of  Defense  (DoD)  effort  to  investigate 
ORS  teehnologies  (Cebrowski  and  Raymond,  2005:77).  In  the  broadest  terms,  the  Air 
Foree’s  goal  is  to  provide  spaee  eapabilities  in  “hours  to  days”  with  the  ORS  eoneept, 
rather  than  the  “weeks  to  months”  eapability  that  exists  in  eurrent  launeh  systems  and 
proeesses  (Stewart,  2003).  The  eoneept  for  ORS  that  Air  Foree  Spaee  Command 
(AFSPC)  is  developing  eonsists  of  three  elements:  a  reusable  first-stage  booster,  an 
expendable  seeond-stage  vehiele,  and  responsive  payloads  (Brown,  2004:3).  The  first 
element  is  where  the  RMFV  eoneept  supports  ORS  development. 

Space  Shuttle  Orbiter  Recovery  Processes 

The  Spaee  Shuttle  Orbiter  post-landing  reeovery  team  eonsists  of  approximately 
150  trained  personnel  to  assist  the  flight  erew  in  leaving  the  orbiter,  make  the  orbiter  safe 
for  towing  and  maintenanee,  prepare  for  towing,  and  tow  the  orbiter  to  the  Orbiter 
Proeessing  Faeility  (OPF)  (NASA  Faets,  2000:7).  The  team  uses  about  25  vehieles  of 
various  size  and  purpose  to  earry  the  variety  of  ground  support  equipment  (GSE)  required 
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to  service  the  orbiter  (NASA  Facts,  2000:7).  The  primary  GSE  that  warrant  discussion 
for  the  purposes  of  this  research  are  the  Purge  Vehicle,  Cooling  Vehicle,  the  Purge  and 
Cooling  Umbilical  Access  Vehicles,  the  fan  trailer,  and  the  hand-held  hazardous  gas 
detectors.  The  Purge  Vehicle  (Figure  2.1),  operated  by  the  Purge,  Vent  and  Drain  (PVD) 
engineering  group,  provides  cooled  and  conditioned  air  through  purge  ducts  with 
tributaries  to  the  forward,  mid-body,  and  aft  cavities  of  the  orbiter  where  there  is  potential 
for  hazardous  gases  to  accumulate,  to  include  the  hydrogen  and  LOX  ducts  that  feed  the 
Space  Shuttle  Main  Engines  from  the  External  Tank  (Wood/Tour). 


Figure  2,1  Purge  Vehicle,  Kennedy  Space  Center 

The  Cooling  Vehicle  (Eigure  2.2),  operated  by  the  Environmental  Control  Systems  (ECS) 
engineering  group,  pumps  chilled  Ereon  R124  refrigerant  into  a  piping  system  that 
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interacts  with  the  orbiter’s  cooling  system  via  an  on-board  heat  exchanger  to  maintain 
temperatures  of  electronics  systems  black  boxes  and  controls  (Wood/Tour). 


Figure  2,2  Cooling  Vehicle,  Kennedy  Space  Center 

The  Purge  and  Cooling  Umbilical  Access  vehicles  (Figure  2.3)  provide  the  PVD  and  ECS 
crews  with  access  to  the  rear  areas  of  the  orbiter  to  connect  the  purge  and  cooling 
umbilicals  (Wood/Tour). 
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Figure  2.3  Purge  Umbilical  Access  Vehicle,  Kennedy  Space  Center 

The  fan  trailer  (Figure  2.4)  is  a  large  fan,  similar  to  agrieultural  fans,  used  to  ereate  an  air 
eurrent  over  the  orbiter  to  redireet  hazardous  away  gases  from  the  erew  compartment  so 
that  crew  recovery  operations  can  continue.  Wind  direction  and  speed  will  determine  the 
use  of  the  fan  machine  and  its  positioning  near  the  orbiter's  nose  section  (Wood/Tour). 
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Figure  2,4  Fan  Trailer 

The  hand-held  hazardous  gas  detectors  are  used  by  ground  safety  assessment  teams  to 
test  and  monitor  the  area  around  the  orbiter  for  the  presence  of  dangerous  levels  of 
hazardous  gases  emanating  from  the  orbiter.  The  team  uses  a  variety  of  detectors,  and 
also  wears  dosimeter  cards  to  monitor  their  exposure  to  the  hazardous  gases 
(Wood/Tour).  The  ground  support  equipment  (GSE)  above,  together  with  the  equipment 
required  to  recover  the  flight  crew,  are  required  to  recover  the  orbiter,  but  only  those 
mentioned  above  apply  directly  to  the  RMLV  post-landing  recovery  model  (NASA  Facts, 
2000:7).  To  understand  the  purpose  of  the  various  vehicles  is  not  enough,  the  macro¬ 
level  processes  must  be  understood  as  well  to  accurately  apply  them  to  the  RMLV  model. 

After  the  orbiter  stops  on  the  runway,  the  recovery  convoy  moves  to  a  position 
1250-feet  from  the  orbiter.  The  safety  assessment  teams  move  forward  ahead  of  the 
convoy  in  protective  suits  and  breathing  apparatus  to  take  vapor  level  readings  and  test 
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for  explosive  and  toxie  gases  that  may  be  present.  Hazardous  gases  that  pose  a  threat  to 
the  flight  and  reeovery  erews  are  hydrogen,  hydrazine,  monomethyl-hydrazine,  nitrogen 
tetroxide  or  ammonia  (NASA  Faets,  2000:7).  If  the  assessment  team  deteets  hazardous 
gases,  the  eonvoy  is  withheld  until  the  fan  trailer  is  in  plaee  and  ean  ereate  suffieient 
airflow  to  redireet  the  hazardous  gases  so  that  reeovery  operations  ean  eontinue 
(Wood/Tour). 

Following  the  fore  and  aft  safety  assessments,  the  Purge  and  Coolant  Umbilieal 
Aeeess  Vehieles  are  positioned  behind  the  orbiter  to  gain  aeeess  to  their  respeetive 
umbilieal  areas.  At  this  time  the  ground  portion  of  the  on-board  hydrogen  deteetion 
system  are  eonneeted  to  the  orbiter  to  determine  the  hydrogen  eoneentration.  If  there  is 
no  threat  to  the  flight  and  ground  erews,  reeovery  operations  eontinue.  If  hydrogen  is 
deteeted,  the  flight  erew  is  evaeuated  immediately,  and  the  ground  erews  are  moved  to  a 
safe  distanee  until  an  emergeney  power-down  of  the  orbiter  is  eomplete  and  the 
hazardous  eondition  is  eliminated  (NASA  Faets,  2000:7-8). 

Onee  the  hydrogen  and  oxygen  umbilieal  lines  are  eonneeted  from  the  Purge 
Umbilieal  Aeeess  Vehiele,  eool  and  eonditioned  air  is  used  to  purge  the  payload  bay  and 
other  eavities  on  the  orbiter  to  remove  residual  or  toxie  fumes  that  may  threaten  the  flight 
or  ground  erews.  The  purge  normally  oeeurs  within  45-60  minutes  after  the  orbiter  stops 
on  the  runway.  At  the  same  time,  the  Coolant  Umbilieal  Aeeess  Vehiele  is  eonneeted  to 
the  orbiter  and  takes  over  eooling  funetions  from  the  orbiter’s  on-board  eooling  system, 
allowing  it  to  be  shutdown  (NASA  Faets,  2000:8).  The  photograph  in  Figure  2.5  shows 
the  Purge  and  Cooling  umbilieal  aeeess  vehieles  in  plaee  and  the  ground  erew  eonneeting 
the  umbilieals  to  the  orbiter. 
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Dryden  Flight  Research  Center  EC90  129-6  Photographed  4/90 
Shuttle  recovery  team  in  action  following  landing  of  STS-31  on  Dryden  runway  22. 

NASA  photo. 


Figure  2,5  Purge  and  Cooling  Vehicles  Connected  to  Space  Shuttle  Orhiter 

When  the  area  in  and  around  the  orhiter  is  safe,  the  Crew  Hatch  Access  Vehicle 
moves  to  the  hatch  side  of  the  orhiter  and  is  mated  to  the  hatch.  The  flight  crew  egresses 
the  orhiter  after  a  preliminary  medical  examination,  usually  within  an  hour  of  landing. 
Exiting  through  the  “white  room”  attached  to  the  Crew  Hatch  Access  Vehicle  to  the  Crew 
Transport  Vehicle,  the  flight  crew  departs  the  orhiter  after  the  commander,  and 
occasionally  other  crew  members,  performs  a  walk  around  the  orhiter  (NASA  Facts, 
2000:8). 

After  the  crew  exits  the  orhiter  and  the  ground  cooling  is  initiated,  Johnson  Space 
Center  (JSC)  transfers  orhiter  control  to  Kennedy  Space  Center  (KSC).  At  this  point  the 
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exchange  support  personnel  enter  the  orbiter  to  prepare  it  for  towing  operations  by 
installing  switch  guards  and  removing  data  packages  from  on-board  experiments  (NASA 
Facts,  2000:8). 

A  total  safety  downgrade  decision  is  made,  enabling  the  ground  crew  to  continue 
with  tow  preparations.  The  final  tow  preparations  include  installing  landing  gear  lock 
pins,  positioning  the  tow  vehicle,  and  connecting  the  tow  bar.  Tow  typically  begins 
within  four  hours  of  landing  and  is  complete  within  six  hours  of  landing  (NASA  Facts, 
2000:8).  It  is  important  to  note,  as  seen  in  Figure  2.6  which  shows  the  orbiter  nearing  the 
end  of  the  towing  process,  that  during  towing  operations  the  Purge  and  Cooling  vehicle 
are  both  connected  to  the  orbiter  and  operating  during  the  entire  towing  operation  (Tour). 


Figure  2,6  Towing  Orbiter  with  Purge  and  Cooling  Vehicles  Connected 

During  the  post-landing  recovery  operation,  an  engineering  test  team  monitors 
data  from  orbiter  systems  from  one  of  the  Launch  Control  Center’s  firing  rooms.  Once 
orbiter  control  is  handed  over  to  KSC,  this  engineering  team  can  issue  commands  to  the 
orbiter  to  configure  specific  orbiter  systems  for  towing  to  the  OPF  (NASA  Facts, 
2000:8). 
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Fighter  Aircraft  Recovery  Processes 

The  post-landing  recovery  process  for  the  F-16  tighter  aircraft  requires  some 
minor  pieces  of  GSE,  and  typically  only  four  personnel  (Kirk).  The  GSE  required 
includes  an  oil  servicing  unit,  aircraft  boarding  ladder,  fire  extinguisher,  various  ground 
lock  and  safety  pins,  and  aircraft  grounding  and  communications  equipment  (T.O.  lE- 
16CG-6WC-1-1 1:4-004). 

The  process  begins  when  the  pilot  taxies  the  aircraft  to  the  recovery  apron.  The 
ground  crew  first  inspects  the  aircraft  for  indications  of  the  hydrazine  powered 
emergency  power  unit  (EPEi)  having  been  used  during  the  flight  and  for  hydrazine  leaks. 
If  there  are  indications  that  the  EPEI  was  used,  the  ground  crew  must  confirm  with  the 
pilot  that  it  was  used  during  the  flight  and  is  no  longer  running.  If  the  EPU  is  running,  or 
there  are  indications  of  a  hydrazine  leak,  local  base  emergency  procedures  dictate  the 
ground  crew’s  actions.  If  all  indications  are  normal,  the  ground  crew  proceeds  with 
aircraft  recovery  (T.O.  1P-16CG-6WC-1-1 1:4-007). 

The  ground  crew  then  installs  and  verifies  safety  pins  are  installed  in  the  weapons 
and  external  fuel  tank  pylons,  missile  launchers,  gun  firing  circuit,  and  the  chaff-flare 
dispenser  (T.O.  1P-16CG-6WC-1-1 1:4-008).  The  pylon  and  missile  launcher  safety  pins 
are  installed  to  prevent  inadvertent  firing  of  the  pyrotechnics  used  to  separate  the  pylon 
from  the  aircraft  in-flight.  The  gun  firing  circuit  safety  pin  prevents  inadvertent  firing  of 
the  gun  on  the  aircraft.  The  chaff-flare  safety  pin  prevents  the  accidental  dispensing  of 
chaff  and  flares.  All  of  these  actions  protect  the  ground  crew  and  other  personnel  that 
may  be  in  the  area. 
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Following  the  safety  pin  installation,  the  aireraft  is  parked.  During  this  proeess 
the  ground  erew  inspeets  for  hot  brakes,  a  eondition  that  eould  result  in  a  life-threatening 
tire  blowout.  Once  the  aircraft  is  in  position,  chocks  are  installed  to  prevent  rolling  and 
the  ground  crew  inspects  the  aircraft  tires.  Finally,  the  ground  crew  installs  the  cord  on 
the  headset/microphone  and  establishes  communication  with  the  aircrew  (T.O.  1F-16CG- 
6WC-l-ll;4-009- 4-011). 

The  communication  link  allows  the  ground  crew  to  confirm  with  the  aircrew  the 
condition  of  the  EPU  prior  to  installing  the  EPU  ground  safety  pin.  The  EPEl  ground 
safety  pin  prevents  the  firing  of  the  EPEl  and  the  hazardous  condition  that  would  result 
from  exposure  to  hydrazine  and  exhaust  from  the  EPU  (T.O.  1P-16CG-6WC-1-1 1:4- 
012). 

The  final  portion  of  the  post-landing  recovery  process  involves  inspecting  for 
various  fluid  leaks  from  the  aircraft  prior  to  the  pilot  taxiing  the  aircraft  to  the 
maintenance  area  to  turn  the  aircraft  over  to  maintenance  crews  to  service  the  aircraft 
(T.O.  IE- 1 6CG-6WC- 1-11 :4-0 13-4-014). 

The  entire  post-landing  recovery  process  for  the  E-16  typically  takes  3-4  minutes 
from  start  to  finish.  Many  processes,  such  as  installation  of  ground  safety  pins,  are 
performed  in  parallel.  Also,  based  on  the  number  of  times  the  operation  has  run  since  the 
introduction  of  the  E-16  in  the  mid-1970’s,  the  process  is  as  refined  as  possible. 

Comparing  Space  Shuttle  Orbiter  and  F-16  Post-Landing  Recovery  Processes 

Comparing  the  Space  Shuttle  Orbiter  and  E-16  post-landing  recovery  operations 
reveals  some  useful  lessons  for  the  proposed  RMEV.  The  two  operations  share  some  of 
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the  simpler  proeesses,  but  what  is  of  greatest  interest  are  the  proeesses  whieh  share  the 
same  purpose,  but  the  eomplexity  of  the  proeesses  based  on  the  vehiele  system  design  are 
dramatieally  different.  The  result  is  significantly  longer  process  times  for  the  orbiter.  In 
addition  to  process  complexity,  the  orbiter  also  requires  activities  not  performed  on  the  F- 
16  based  on  its  system  design. 

The  orbiter  and  F-16  share  the  common  processes  of  requiring  ground  safety  pins 
and  ground  lock  pins  to  be  installed  in  various  portions  of  the  vehicle,  such  as  the  landing 
gear  and  pyrotechnics.  Most  of  these  simpler  processes  are  so  similar  for  the  two 
vehicles,  they  can  be  considered  the  same  in  both  function  and  approximate  duration. 
These  are  also  the  processes  that  are  likely  to  be  required  no  matter  what  the  design  of  the 
RMLV. 

The  orbiter  and  F-16  also  share  processes  that  have  a  common  purpose,  such  as 
protect  the  ground  and  flight  crew  from  hazardous  gases  associated  with  the  hydrazine 
powered  APU  on  the  orbiter  and  the  hydrazine  powered  EPU  on  the  F-16,  but  the  actual 
processes  used  vary  in  complexity  and  length.  The  process  for  the  orbiter  requires 
several  personnel  with  hand-held  sensors  to  take  readings  close  to  the  orbiter  to 
determine  whether  a  hazardous  condition  exists,  with  no  other  activities  occurring  until 
the  area  is  deemed  safe  for  flight  and  ground  crews.  The  F-16  process  involves  a  visual 
check  of  the  EPU  firing  indicator  and  a  visual  inspection  for  leaks,  and  a  follow-up 
confirmation  that  the  flight  crew  has  no  indications  of  a  hazardous  condition.  The  orbiter 
process  takes,  on  average,  12-minutes  for  the  fore  and  aft  assessments,  performed 
concurrently  (see  Attachment  2).  The  P-16  process  takes  less  than  five  minutes 
(Koehler).  Clearly,  the  two  processes  are  substantially  different,  the  advantage  going  to 
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the  F-16  process  for  having  on-board  indications,  given  to  the  maintenance  crew  in  the 
form  of  a  warning  flag  on  the  external  surface  of  the  aircraft  and  communication  from  the 
pilot,  instead  of  external  sensors  to  reduce  the  time  required  to  conduct  the  safety 
assessment. 

The  Space  Shuttle  Orb  iter  is  subject  to  four  processes  during  post-landing 
recovery  that  are  not  performed  on  the  F-16  aircraft.  The  first  is  the  purge  process,  the 
functions  of  which  are  performed  by  the  purge  equipment  on  the  Purge  Vehicle  described 
earlier  in  this  chapter.  The  second  process  is  ground  cooling  which  requires  the  Cooling 
Vehicle,  also  described  earlier  in  this  chapter.  The  third  process  is  the  removal  of  the 
flight  crew  on  the  runway.  In  the  F-16  process,  the  flight  crew  does  not  leave  the  aircraft 
until  it  reaches  the  maintenance  area  while  the  orbiter  crew  exits  the  vehicle  on  the 
runway  as  a  part  of  the  post-landing  recovery  process.  The  fourth  is  the  movement  from 
the  recovery  area  to  the  maintenance  facility.  As  discussed  earlier,  the  orbiter  travels  in  a 
convoy  from  the  runway  to  the  OFF,  towed  by  a  tug,  and  with  the  Purge  and  Cooling 
vehicles  following  with  their  respective  umbilicals  connected  to  the  orbiter.  The  process 
and  coordination  required  to  tow  the  orbiter  to  the  OPF  is  far  more  complex  and  time 
consuming  than  the  process  to  taxi  the  F-16  from  the  recovery  area  to  the  maintenance 
area. 

Summary 

This  chapter  provided  the  necessary  background  in  the  future  Air  Force  spacelift 
objectives,  and  the  Space  Shuttle  orbiter  and  F-16  post-landing  recovery  processes,  and 
provides  a  comparison  of  the  Space  Shuttle  and  F-16  processes.  Future  Air  Force  spaclift 
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objective  address  the  requirement  for  responsive  space  lift  with  the  capabilities  to 
respond  to  spacelift  requests  in  hours  to  days  instead  of  the  weeks  to  months  required 
with  current  systems.  The  orbiter  and  F-16  processes  were  used  as  the  basis  for  the 
RMLV  process  model,  with  an  emphasis  on  orbiter  processes  due  to  the  unique  nature  of 
space  systems  and  the  need  to  address  the  maximum  number  of  possible  design  issues. 
Finally,  the  comparison  of  the  F-16  and  orbiter  processes  demonstrates  the  need  to  not 
simply  copy  the  Space  Shuttle  Orbiter  in  designing  the  RMLV  if  the  Air  Force  is  to  meet 
its  performance  goals.  Next,  Chapter  III  will  discuss  the  methodology  used  to  develop, 
verify,  and  validate  the  RMLV  post-landing  recovery  model. 
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III.  Methodology 


Introduction 

This  chapter  explains  the  methodology  used  to  develop  the  RMLV  post-landing 
vehicle  reeovery  operations  simulation  model.  The  first  seetion  will  explain  the 
advantages  of  using  discrete-event  simulation  modeling  for  the  problem  of  RMLV  post¬ 
landing  vehiele  recovery  operations.  The  second  section  will  explain  the  12-step 
modeling  proeess  used  to  build  the  model. 

Advantages  of  Using  Discrete-Event  Simulation  Modeling 

Discrete-event  simulation  modeling,  in  general,  is  an  excellent  tool  for  evaluating 
new  or  changing  systems.  In  relation  to  the  RMLV,  discrete-event  simulation  is  an 
appropriate  tool  for  assisting  in  designing  new  systems.  The  simulation  can  allow  the 
designers  to  experiment  with  internal  interactions  of  complex  systems,  such  as  the 
RMLV.  It  can  also  provide  valuable  insight  into  which  variables  are  most  important  to 
process  interactions.  The  most  important  advantage  of  simulation  for  the  RMLV  design 
proeess  is  the  ability  to  evaluate  various  designs  without  eommitting  resources  to 
building  the  actual  hardware  (Banks  and  others,  2005:4-6). 

The  12-Step  Modeling  Process 

The  12-Step  modeling  proeess  described  by  Banks  et  al.  is  designed  to  guide 
model  development  for  a  broad  range  of  applications  (Banks  and  others,  2005:15).  The 
first  seven  steps  of  the  process  guide  model  development,  while  the  last  five  steps  guide 
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the  use  or  application  of  the  model  to  analyze  and  make  decisions  about  the  system 
modeled.  The  following  identifies  each  of  the  twelve  steps  of  the  modeling  process  and 
explains  the  actions  taken  to  design  the  RMLV  post-landing  vehicle  recovery  model. 

Step  1:  Problem  Formulation 

The  research  problem  is  the  heart  of  the  entire  modeling  effort,  all  work  is 
centered  on  and  guided  by  the  need  to  solve  the  research  problem  (Banks  and  others, 
2005:14).  The  Air  Force  Research  Laboratory,  Air  Vehicles  Directorate  (AFRLA^A)  is 
in  the  early  stages  of  RMLV  development  and  requires  a  discrete  event  simulation  model 
of  the  RMLV  post-landing  recovery  process  to  assess  the  impact  of  various  vehicle  and 
system  design  options  that  can  work  in  conjunction  with  the  MILePOST  model 
developed  by  Pope  and  Stiegelmeier. 

Step  2:  Setting  of  Objectives  and  Overall  Project  Plan 

Once  the  research  problem  is  made  clear,  the  researcher  must  determine  the 
objectives  of  the  research  effort,  usually  stated  in  the  form  of  research  questions,  and 
design  a  project  plan  to  achieve  those  objectives  (Banks  and  others,  2005:14).  The 
primary  objective  of  this  research  is  to  provide  AFRLA^A  with  an  effective  model  for 
analyzing  design  alternatives  for  the  RMLV  based  on  post-landing  vehicle  recovery 
operations.  The  general  plan  for  accomplishing  that  objective  was  to  apply  this  12-Step 
Modeling  Process  within  an  approximately  five  month  timeline.  The  problem,  research 
objective,  research  question,  and  investigative  questions  were  identified  in  Chapter  1. 

Step  3:  Model  Conceptualization 

Model  conceptualization  is  essentially  the  visualization  and  initial  brainstorming 
work  required  to  begin  building  the  framework  for  the  model  (Banks  and  others. 
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2005:14).  The  author  began  with  broad  eoneepts  of  aircraft  and  Space  Shuttle  orbiter 
post-landing  recovery  operations,  separating  the  processes  into  the  three  broad  categories: 

1 .  Making  the  vehicle  safe  for  ground  crews  -  Actions  required  to  protect  ground 
crews  from  potential  hazards  on  or  near  the  vehicle  due  to  the  nature  of  the 
vehicle  design. 

2.  Protecting  the  vehicle  from  damage  -  Actions  required  to  protect  the  vehicle 
from  damage  during  handling  and  from  the  local  environment. 

3.  Preparing  the  vehicle  for  transportation  and  maintenance  -  Actions  required 
to  prepare  the  vehicle  for  transportation  and  make  it  safe  and  ready  to  enter 
into  the  maintenance  process. 

Once  identified,  the  three  broad  categories  were  used  to  guide  research  into  both  the  F-16 
and  Space  Shuttle  orbiter  post-landing  recovery  operations.  The  research  outlined  in 
Chapter  11  revealed  specific  actions  taken  that  could  be  applied  to  the  more  generic  model 
for  the  RMLV. 

Step  4:  Data  Collection 

Data  collection  requirements  are  based  on  the  research  objectives,  but  typically 
this  step  involves  collecting  and  analyzing  historical  performance  data  for  the  system 
being  modeled  (Banks  and  others,  2005:16).  The  Space  Shuttle  orbiter  post-landing 
recovery  performance  data  was  used  as  the  primary  source  for  data  analysis  with  the  F-16 
data  secondary.  In  initial  analysis  of  the  data,  probability  distributions  were  fit  to  the  data 
for  some  of  the  key  processes  from  the  Space  Shuttle  orbiter  post-landing  recovery  to 
determine  some  core  statistics  such  as  the  mean  and  standard  deviation  for  the  data.  This 
information  was  used  in  initial  modeling  runs,  but  was  later  altered  to  meet  AFRLA^A 
requirements  for  triangular  distributions  with  lower  bounds  set  at  10%  less  than  the  mean 
and  upper  bounds  set  at  40%  above  the  mean.  For  many  of  the  processes  in  the  model 
there  was  no  historical  data  available  for  analysis,  but  the  mean  for  the  processes  were 
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available  for  either  the  Spaee  Shuttle  orbiter  or  the  F-16.  In  general  terms,  the  Spaee 
Shuttle  orbiter  data  was  used  for  the  majority  of  the  RMLV  post-landing  reeovery 
proeesses.  The  F-16  data  was  primarily  used  for  proeesses  involving  the  handling  of 
external  stores  in  the  instanee  of  a  eontingeney  where  the  payload  does  not  suoeessfully 
separate  from  the  RMLV. 

Spaee  Shuttle  Orbiter  data  eame  in  two  forms.  The  first  is  a  timeline  of  all 
proeesses  eondueted  during  Spaee  Shuttle  landing  runway  operations.  The  timelines  for 
eaeh  proeess  are  based  on  historieal  averages  for  that  proeess,  however  the  supporting 
data  is  not  available  to  eonduet  input  analysis  to  determine  appropriate  distributions  and 
varianees  (see  Attaehment  2).  The  seeond  data  souree  is  a  spreadsheet  with  data  on 
proeessing  times  for  eight  key  proeesses  from  the  fifty-eight  Spaee  Shuttle  missions  from 
1991  to  2002.  The  input  analyzer  funetion  of  the  Arena  7.01  software  was  used  to 
eonduet  input  analysis  on  the  data  for  these  eight  key  proeesses.  Input  analysis  involved 
evaluating  the  data  to  determine  the  form  of  the  statistical  distribution  of  the  data.  The 
results  of  the  input  analysis  are  contained  in  Table  3.1. 


Process 

Mean 

Standard 

Deviation 

Distribution 

Chi^ 

Test 

P- 

Value 

Square 

Error 

Reaction  Jet  Drives  /  Hatch 
Safmg 

6.88 

1.98 

Normal 

0.212 

0.013184 

Forward  Downgrade 

12 

2.29 

Gamma 

0.0957 

0.021840 

Aft  Downgrade 

12.8 

2.8 

Weibull 

0.433 

0.008259 

APU  Shutdown 

18.3 

2.68 

Erlang 

0.519 

0.009864 

Left  Hand  Upper  Inspection 

27.1 

4.06 

Lognormal 

0.445 

0.008601 

Right  Hand  Upper  Inspection 

27.7 

4.99 

Gamma 

0.132 

0.017209 

Purge  Initiated 

53.7 

9.62 

Poisson 

0.0226 

0.025838 

Cooling  Initiated 

48.6 

9.61 

Triangular 

0.471 

0.022401 

Table  3.1.  Input  Analysis  Results  for  Eight  Key  Processes 
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The  Arena  input  analyzer  seleets  the  best  distribution  based  on  the  square  error  (Arena). 
The  square  error  is  a  measure  of  the  sample  variability  around  the  fitted  distribution  line, 
with  the  lowest  variability  providing  the  best  fit.  The  seeond  eriterion  for  goodness  of  fit 
is  the  P- Value  from  the  Chi  Test,  whieh  is  desired  to  be  the  highest  for  the  best 
distribution  fit  (Arena).  In  eonsidering  the  P-Value  results  from  the  output  analysis,  the 
APU  Shutdown,  Upper  Left  Hand  Inspeetion,  and  Cooling  Initiated  proeesses  have 
strong  values.  All  others  are  not  as  significant  and  allow  for  more  flexibility  in  choosing 
another  distribution,  if  desired.  After  initial  analysis,  all  distributions  were  made 
triangular  according  to  AFRL/VA  requirements.  While  providing  an  evaluation  of  the 
system  dynamics  under  different  RMLV  designs,  the  RMLV  post-landing  model  also  is 
victim  of  one  of  the  disadvantages  of  modeling  and  simulation,  limited  or  incomplete 
data  (Carson,  2005:18).  Essentially,  there  is  no  complete  data  set  for  all  the  processes  in 
the  RMLV  post-landing  system. 

The  F-16  data  came  in  the  form  of  average  process  time  for  the  complete  post¬ 
landing  recovery  process,  provided  by  the  Second  Lieutenant  Abby  Keohler,  an  F-16 
maintenance  officer.  Individual  process  data  for  the  F-16  was  not  available  for  this  study. 
Additional  information  came  from  the  personal  insight  and  experience  of  Major  Timothy 
Kirk,  a  former  F-16  maintenance  officer. 

Step  5:  Model  Translation 

The  conceptual  model  developed  in  Step  3  must  be  translated  into  a  computer 
modeling  software  package  in  order  to  study  the  representation  of  the  real  world  system 
(Banks  and  others,  2005:16).  The  RMLV  post-landing  vehicle  recovery  operations 
model  was  built  in  Arena  computer  simulation  software  according  to  AFRLWA 
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requirements.  The  primary  ehallenge  in  translating  the  eoneeptual  model  into  a  eomputer 
simulation  model  is  in  ensuring  the  eoneeptual  proeesses  are  aeeurately  represented  in  the 
model  aeeording  to  how  the  software  handles  the  data.  Step  6  addresses  this  ehallenge. 

Step  6:  Verification 

Model  verifieation  is  the  proeess  used  to  eonfirm  the  model  works  eorreetly  as  it 
is  designed.  Verifieation  will  often  inelude  debugging  of  the  software  and  testing  the 
model  to  ensure  it  behaves  properly  aeeording  to  the  modeler’s  intent  (Banks  and  others, 
2005:16).  The  proeess  ean  inelude  stress  tests  on  the  model  using  different  random 
numbers,  a  review  of  model  outputs,  software  debugging,  seleetive  traees  throughout  the 
model,  and  review  by  more  senior  simulation  analysts  (Carson,  2005:21).  Of  these 
possible  methods,  this  researeher  used  the  Arena  software  debugger  to  identify  problems 
in  the  model  logie,  a  review  of  model  outputs  against  expeeted  results,  and  seleetive 
traees  through  the  assertion  eheeking  proeess. 

During  initial  simulation  runs  the  Arena  software  debugger  identified  errors  in 
logie  regarding  resourees  that  were  refereneed  but  not  defined  in  the  system.  These 
problems  were  easily  resolved  beeause  the  refereneed  resourees  were  residual  from  early 
versions  of  the  model  and  were  no  longer  required. 

Output  analysis  identified  a  major  problem  in  the  model.  In  early  runs,  the  model 
aeeurately  entered  one  entity  into  the  system,  but  three  to  four  entities  would  exit  the 
system  eausing  errant  output  data.  The  problem  was  found  in  two  of  the  separator 
modules  used  to  model  parallel  proeesses,  whieh  were  set  to  produee  four  duplieates 
instead  of  the  needed  one  duplieate.  The  result  was  the  batehing  module  ereated  entities 
with  the  additional  duplieates  aeeording  to  their  programmed  logie.  This  problem  was 
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easily  resolved,  and  subsequent  simulation  runs  produeed  the  expeeted  one  entity  per 
replieation. 

The  assertion  eheeking  method  was  used  to  test  the  model  to  ensure  it  performs  as 
expeeted  based  on  known  inputs.  The  assertions  are  made  in  the  model  in  the  form  of 
dietating  the  deeisions  made  for  the  deeision  modules,  and  then  the  model  is  run  and  the 
output  results  eompared  to  the  expeeted  results  to  determine  whether  the  model  performs 
eorreetly  (DoD  W&A,  1996:4-13).  For  this  model,  the  design  deeisions  made  using  the 
rudimentary  user  interfaee  were  the  assertions  and  the  use,  or  laek  of  use,  for  the 
resourees  assigned  to  eaeh  proeess  that  would  be  used  based  on  the  deeision  were  the 
markers  to  indieate  whether  the  deeision  module  performed  eorreetly  based  on  the  input 
from  the  user  interfaee. 

Step  7:  Validation 

Validation  is  the  proeess  of  ensuring  the  model  aeeurately  portrays  the  system  it  is 
intended  to  model.  Validation  is  an  iterative  proeess  in  whieh  the  simulation’s  behavior 
is  eompared  to  the  behavior  of  the  real  world  system  to  ensure  the  real  world  system’s 
behavior  is  aeeurately  represented  in  the  model  (Banks  and  others,  2005:16).  Many 
methods  are  available  to  validate  a  model,  but  two  primary  methods  were  used  in  this 
model.  First,  the  Delphi  proeess  was  applied  to  gain  the  advantage  of  having  experts 
from  the  fields  of  Spaee  Shuttle  orbiter  and  F-16  post-landing  vehiele  reeovery  operations 
review  the  eonstruet  of  the  model  to  ensure  all  of  the  neeessary  proeesses  are  eaptured  in 
the  model,  as  well  as  all  potential  design  options  (Delphi).  The  Delphi  proeess  was 
partieularly  useful  in  the  development  of  this  model  beeause  a  reusable,  unmanned  first- 
stage  launeh  vehiele  does  not  eurrently  exist.  Laeking  direet  data  or  knowledge  of  how 
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design  decisions  would  affect  the  performance  of  the  RMLV,  drawing  on  the  knowledge 
of  experts  from  different  areas  allows  the  modeler  to  determine  system  performance  with 
a  good  degree  of  certainty  in  the  absence  of  data.  MacMillan  and  Marshall  used  this 
approach  in  constructing  models  to  determine  the  impact  of  environmental  factors  on 
endangered  species  when  the  scientific  data  supporting  a  decision  guiding  model  was 
missing  or  inadequate.  MacMillan  and  Marshall  found  that  the  application  of  the  Delphi 
process  to  model  construction  was  useful  and  effective  in  developing  working  models  to 
help  guide  forestry  decisions  to  assist  in  the  recovery  of  the  endangered  populations  when 
complete  data  is  not  available  (MacMillan  and  Marshall,  2005:1 1,18). 

Second,  the  model  output  was  analyzed  to  assess  its  reasonableness  when 
compared  to  the  data  it  was  built  upon.  Individual  processes  were  not  assessed  for  their 
reasonableness.  The  overall  process  output,  the  time  to  completion  was  compared  against 
the  Space  Shuttle  Orbiter  process  times  to  determine  the  reasonableness  of  the  model  as 
constructed  with  favorable  results. 

Step  8:  Experimental  Design 

In  the  experimental  design  step,  the  modeler  designs  a  framework  for 
experimentation  to  evaluate  the  alternative  designs  for  the  system  modeled  (Banks  and 
others,  2005:16-17).  The  author  conducted  preliminary  experiments  to  test  the  vehicle 
and  system  design  alternatives  that  are  available  in  the  model  using  the  Space  Shuttle 
orbiter  and  F-16  derived  distributions.  The  purpose  of  these  experiments  was  to  assist  in 
model  validation  and  verification. 
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Step  9:  Production  Runs  and  Analysis 

Production  runs  are  required  to  produce  the  data  required  to  analyze  the 
alternative  designs  in  the  system  (Banks  and  others,  2005:17).  The  preliminary 
production  runs  were  used  to  help  verify  and  validate  the  model  for  this  researeh.  The 
produetion  runs  to  evaluate  the  design  alternatives  will  be  performed  by  AFRLA^A 
researehers.  However,  these  production  runs  will  be  run  on  the  consolidated  MILePOST 
regeneration  model. 

Step  10:  More  Runs? 

The  purpose  of  this  step  is  to  determine  whether  more  experimentation  is  required 
to  aehieve  the  purposes  of  the  analysis  (Banks  and  others,  2005:17).  More  experiment 
runs  may  be  required  to  improve  the  statistieal  signifieance  of  the  results,  or  the 
experiment  may  need  to  be  altered  to  better  test  the  alternatives  the  customer  is  interested 
in.  In  the  case  of  this  model,  AFRLA^A  will  eonduct  any  further  experiments  with  the 
model. 

Step  11:  Documentation  and  Reporting 

Documentation  can  take  two  forms,  program  and  progress.  Program 
doeumentation  is  designed  to  communieate  how  the  computer  program  works  for  later 
users  (Banks  and  others,  2005:17).  The  Arena  computer  modeling  software  used  in  this 
researeh  is  well  doeumented  as  a  commereial  product  and  requires  no  further 
doeumentation.  Progress  documentation  and  reporting  reeords  and  communicates  the 
history  and  suecess  of  the  modeling  projeet  (Banks  and  others,  2005:17).  Progress 
reporting  for  this  research  is  satisfied  in  the  text  of  this  doeument,  however,  AFRLA^A 
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will  have  additional  progress  reporting  requirements  to  report  the  results  of  the 
produetion  and  analysis  phase  of  the  eompleted  modeling  project. 

Step  12:  Implementation 

Implementation  is  the  use  of  the  information  and  insight  gained  from  the 
simulation  model  to  help  guide  decisions  in  the  design  of  the  real-world  system  (Banks 
and  others,  2005:17-18).  The  purpose  of  this  research  is  not  to  implement  decisions,  but 
rather  to  equip  AFRL/VA  with  a  simulation  model  to  conduct  their  own  analysis  of 
potential  RMLV  designs  and  implement  the  results  at  some  future  date.  This  research 
will  not  make  or  implement  any  decisions  resulting  from  the  use  of  this  model. 

Summary 

Chapter  III  described  the  advantages  of  using  discrete-event  simulation  and  the 
process  used  to  develop  the  RMLV  post-landing  vehicle  recovery  operations  computer 
simulation  model.  The  12-Step  process  from  Banks  et.  al.  provided  the  framework  for 
the  development  of  the  problem,  objectives,  the  model,  verification  and  validation,  and 
progress  reporting.  The  remainder  of  the  12-Step  process  is  incumbent  of  AFRLA^A  to 
complete  to  ensure  accurate  production  runs,  continued  reporting,  and  implementation  of 
the  design  insights  gained  from  the  use  of  the  RMLV  post-landing  recovery  operations 
computer  simulation  model. 
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IV.  Results  and  Analysis 


Introduction 

This  chapter  describes  the  model  created  for  this  research  and  presents  the  results 
of  the  model  verification  and  validation  processes  explained  in  Chapter  III. 

Model  Description 

The  Arena  computer  simulation  modeling  software  was  used  to  develop  this 
model.  A  rudimentary  user  interface  was  developed  in  Microsoft  Excel  software  to  allow 
the  user  to  change  the  distributions  used  for  each  process  and  direct  entity  behavior  in  the 
decision  modules.  The  entire  RMLV  post-landing  vehicle  recovery  operation  can  be 
broken  down  into  seven  segments: 

1 .  Landing,  taxi  (if  capable),  and  initial  safing 

2.  Safety  assessment  and  final  safety  call 

3.  RMLV  preparation  for  transportation 

4.  Handling  external  stores  (if  required) 

5.  Safing  sequence 

6.  Tow  preparation 

7.  Towing  to  the  maintenance  facility 

Some  of  these  segments  occur  in  parallel,  such  as  the  safing  sequence  and  tow 
preparation.  Segment  3  is  non-contiguous  and  occurs  in  two  small  segments  separated  by 
Segment  4.  Each  segment  involves  several  individual  processes  required  to  safely 
recover  the  vehicle  and  transport  it  to  the  maintenance  facility. 
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Segement  1:  Landing,  Taxi,  and  Initial  Safing 


The  first  segment  of  the  model  ineludes  the  process  modules  that  represent  the 
activities  required  to  safe  portions  of  the  RMLV  which  pose  a  threat  to  the  ground  crew. 
The  first  decision  module  provides  the  option  to  make  the  RMLV  capable  of  taxiing.  The 
first  process  is  for  the  RMLV  to  taxi  off  the  runway  to  the  recovery  apron,  if  capable. 

The  second  process  represents  the  safing  of  the  reaction  jet  drives  and  drag  chute 
pyrotechnics.  The  next  module  is  a  decision  module  that  allows  the  designers  to  evaluate 
the  advantages  and  disadvantages  of  have  the  RMLV  capable  of  automatic  auxiliary 
power  unit  (APU)  shutdown.  If  the  RMLV  is  capable,  the  entity  in  the  model  will 
proceed  directly  to  the  next  process,  if  not,  the  entity  will  enter  the  process  for  ground 
crew  shutdown  of  the  APU.  The  final  process  represents  the  ground  crew  safing  of  the 
LOX  tank  to  ensure  no  venting  occurs  which  could  produce  a  fire  hazard  condition. 


Segment  2:  Safety  Assessment  and  Final  Safety  Call 
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This  segment  is  broken  down  into  two  portions,  the  first  being  the  initial  safety 
assessment  required  to  determine  if  it  is  safe  for  the  ground  crews  to  continue 
maintenance  on  the  RMLV,  and  the  second  being  the  final  safety  call  to  allow  complete 
recovery  processing  and  transportation  to  the  maintenance. 

The  first  module  is  a  decision  module  which  allows  designers  to  evaluate  the 
impact  of  having  hypergolic  fuels  on  the  RMLV.  If  the  RMLV  does  not  include 
hypergolic  fuels,  the  entity  in  the  model  by-passes  Segment  2  of  the  model  and  continues 
into  Segment  3.  If  it  does  include  hypergolic  fuels,  the  designer  has  the  option  to  make 
the  safety  assessment  regarding  hazardous  gases  associated  with  hypergolic  fuels 
automated  within  the  RMLV,  or  to  require  ground  support  equipment  sensors  operated  by 
the  ground  crews  to  conduct  the  safety  assessment.  If  the  safety  assessment  is  automated, 
the  entity  proceeds  to  the  decision  module  representing  the  outcome  of  the  assessment.  If 
the  ground  crew  must  conduct  the  safety  assessment,  the  entity  enters  the  parallel  process 
modules  representing  both  the  forward  and  aft  safety  assessments  before  proceeding  to 
the  decision  module.  The  final  process  in  this  segment  represents  maintenance  actions 
required  to  make  conditions  safe  around  the  RMLV  should  the  safety  assessment  team 
detect  hazardous  gases.  This  process  is  analogous  to  the  requirement  to  use  the  fan  trailer 
on  the  Space  Shuttle  orbiter  recovery. 
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Segment  3  (Part  1):  RMLV  Preparation  for  Transportation 


Segment  3  is  represented  in  two  portions  of  the  model.  The  first  portion  ineludes 
actions  that,  if  required,  should  be  addressed  before  any  other  actions  are  taken  in  order 
to  protect  the  RMLV  and  make  it  ready  to  enter  the  maintenance  facility  as  quickly  as 
possible.  The  second  portion  includes  what  may  be  considered  less  critical  actions  which 
are  still  required  prior  to  towing  operations. 

The  first  portion  of  Segment  3  includes  several  parallel  processes.  The  first 
involves  the  decision  to  design  a  RMLV  requiring  purging  due  to  the  potential  presence 
hazardous  gases.  The  ground  crew  must  connect  GSE  to  conduct  a  hazardous  gas  purge, 
initiate  the  purge,  and  monitor  for  any  leaks.  If  the  RMLV  design  does  not  include  the 
requirement  to  purge  hazardous  gases,  the  decision  module  bypasses  these  processes. 

The  second  of  the  parallel  processes  represents  the  design  decision  for  a  RMLV  that 
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requires  external  cooling  to  protect  on-board  components.  If  cooling  is  required,  the 
ground  crews  must  connect  GSE  and  conduct  cooling  operations  to  protect  the  internal 
RMLV  components.  If  cooling  is  not  required,  the  entity  bypasses  the  cooling  processes. 
The  final  three  parallel  processes  represent  ground  crew  actions  required  to  install 
landing  gear  lock  pins  and  protective  covers  on  surface  vents.  Ground  crews  conduct  a 
superficial  inspection  for  damage  to  the  RMLV  thermal  protection  system  (TPS)  and  for 
debris  that  could  further  damage  the  RMLV  or  pose  a  hazard  to  ground  crews  and 
equipment  should  the  RMLV  be  moved,  and  any  additional  RMLV  configuration  actions 
required  before  turning  over  control  of  the  RMLV. 

Segment  4:  Handling  External  Stores 


Load  and 
Remove  External 
Stores 

' 

This  segment  of  the  operation  allows  the  designers  to  decide  if  the  RMLV  should 
be  capable  of  returning  with  external  stores.  If  the  RMLV  can  return  with  external  stores, 
designers  can  choose  to  evaluate  the  impact  of  this  contingency.  The  three  process 
modules  represent  the  positioning  of  GSL,  the  separation  of  the  external  stores  from  the 
RMLV,  and  the  removal  of  the  external  stores  from  the  area,  hollowing  the  removal  of 
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the  external  stores  the  entity  proceeds  to  the  decision  module  for  safety  downgrade 
where,  if  passed,  it  will  continue  with  recovery  operations.  If  the  safety  downgrade  fails, 
the  entity  is  sent  to  a  process  module  that  represents  the  additional  maintenance  required 
to  correct  the  problem  causing  the  failure,  then  continues  with  recovery  operations. 

Segment  5:  Safing  Sequence 


The  safing  sequence  includes  several  activities  that  are  expected  to  be  required 
regardless  of  RMLV  design,  and  a  few  that  will  only  be  required  if  the  design  includes 
the  use  of  hypergolic  fuels.  The  first  process  represents  the  safing  of  the  orbital 
maneuvering  system  (OMS)  reaction  control  system  (RCS)  to  ensure  the  RCS  does  not 
inadvertently  fire  and  harm  ground  personnel  or  damage  the  maintenance  facility  and 
RMLV.  The  second  process  represents  the  venting  of  fuels  and  fumes  from  the  RMLV 
main  engine  (ME)  tanks  to  ensure  potential  hazards  are  eliminated  prior  to  the  vehicle 
entering  the  maintenance  facility.  The  third  process  represents  the  configuration  for  the 
main  propulsion  system  (MPS)  to  prepare  it  to  enter  the  maintenance  facility. 

The  decision  module  following  the  third  process  allows  the  designers  to  evaluate 
the  impact  of  using  hypergolic  fuels.  If  included,  the  entity  proceeds  to  the  hydrazine 
circulation  pump  safing  process,  followed  by  the  storing  of  the  air  data  probes.  If 
hypergolic  fuels  are  not  used,  the  entity  bypasses  the  two  processes.  Additionally,  if 
hypergolic  fuels  are  used,  but  the  RMLV  has  autonomous  hazardous  gas  detection,  the 
entity  bypasses  the  air  data  probe  storage  process. 
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The  final  process  represents  the  safing  of  the  inertial  navigation  system  (INS). 


Following  this  process,  the  entity  proceeds  to  the  towing  process. 


Segment  3  (Part  2):  RML  V  Preparation  for  Transportation 


The  second  portion  of  the  RMLV  preparation  for  transportation  occurs  in  parallel 
with  the  safing  sequence,  and  includes  several  parallel  processes.  The  first  parallel 
process  represents  actions  to  place  protective  covers  on  various  RMLV  equipment.  The 
decision  module  allows  designer  to  determine  if  protective  covers  are  required  to  protect 
the  RMLV  components  during  the  towing  operation.  The  remaining  parallel  processes 
represent  actions  to  position  the  tow  tug  and  the  monitoring  of  on-board  systems. 

Segment  6:  Tow  Preparation 


The  final  tow  preparations  also  occur  in  parallel  with  the  safing  sequence.  The 


three  processes  include  hooking  the  tow  tug  to  the  RMLV,  checking  the  connections,  and 
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conducting  final  preparation  actions  such  as  removing  ehoeks,  if  required.  Onee  these 
actions,  and  the  actions  in  Segment  5,  are  complete  the  entity  proceeds  to  towing 
operations. 

Segment  7:  Towing  to  the  Maintenance  Facility 


The  final  segment  of  the  model  only  represents  the  towing  operation  to  the 
maintenance  facility,  but  includes  other  important  modules  for  the  model.  The  first  is  a 
record  module  whieh  eleetronieally  records  data  on  the  entity.  The  second  is  the  dispose 
module  which  also  electronically  records  data  on  the  entity,  such  as  total  time  in  system, 
and  disposes  of  the  entity  for  logie  continuity.  As  a  stand-alone  model,  the  disposal 
function  is  important,  however  it  will  be  removed  when  the  model  is  added  to  the  larger 
MILePOST  model  construeted  by  Captains  Pope  and  Stieglmeier. 

Model  Verification 

Three  methods  of  verification  were  used  for  the  RMLV  post-landing  recovery 
operations  model;  Arena’s  internal  software  debugging  utilities,  output  analysis,  and  the 
assertion  checking  method  similar  to  the  methods  used  by  Captains  Pope  and  Stieglmeier. 
The  results  of  the  Arena  internal  software  debugging  and  output  analysis  are  diseussed  in 
Chapter  III. 
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In  the  assertion  cheeking  verification  process,  the  use  of  resources  specific  to  each 


process  was  tracked  during  forty  replications  of  the  model  for  three  separate  design 
decision  treatments.  In  each  treatment,  the  design  decisions  were  made  within  the 
rudimentary  Excel  spreadsheet  user  interface  and  recorded.  The  model  was  then  run  and 
the  use  of  resources  tracked.  Based  on  design  decisions,  specific  resources  should  be 
used  during  each  replication.  The  first  treatment  evaluated  answering  “no”  to  all  design 
questions.  The  second  treatment  was  a  simple  assessment  of  the  impact  of  answering 
“yes”  to  all  questions  regarding  design  decisions.  The  third  treatment  evaluated  the 
decision  to  exclude  all  design  features  the  author  considered  to  be  detrimental  to 
minimizing  RMLV  regeneration  time.  Table  4.1  shows  the  results  of  the  first  replication 
of  the  first  treatment.  The  first  column  is  the  design  question  considered,  the  second 
answer,  with  a  “1”  for  a  “yes”  answer  and  a  “0”  for  a  “no”  answer.  The  third  column  is 
the  resource  that  would  be  used  based  the  answer  to  the  design  question,  and  the  fourth 
column  is  number  of  times  the  resource  was  utilized. 


Design  Question 

Answer 
“1”  =  Yes 
“0”  =  No 

Associated  Resource 

Utilization 

Does  APU  shutdown 
automatically? 

0 

APU  GSE 

1 

Does  design  include  hypergolics? 

0 

-  Forward  Safety  Assessment  GSE 

0 

-  Aft  Safety  Assessment  GSE 

0 

Do  internal  structures  require 
purge  and  inerting? 

0 

Purge  GSE 

0 

External  Ground  Cooling 

Required? 

0 

Cooling  GSE 

0 

Can  RMLV  return  with  external 
stores? 

0 

External  stores  separation  GSE 

0 

MPS  and  RMLV  require 
protective  covers? 

0 

Protective  cover  GSE 

0 

Table  4,1:  Verification  Results  from  First  Treatment 
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In  all  assertion  checking  verification  runs  the  model  performed  as  expected.  From  these 
results,  the  conclusion  is  the  rudimentary  user  interface  is  sufficient  and  the  model  will 
run  as  expected  according  to  the  inputs  into  the  user  interface. 

Model  Validation 

Two  methods  were  used  to  validate  the  model,  the  Delphi  process  and  comparison 
of  the  models  performance  against  the  real  world  system.  Both  methods  were  described 
in  Chapter  III,  the  results  of  each  validation  process  are  discussed  here. 

Delphi  Process 

The  Delphi  Process  drew  from  the  expertise  of  professionals  in  the  field  of  Space 
Shuttle  Orbiter  post-landing  recovery  operations  and  F-16  fighter  aircraft  maintenance 
operations,  which  include  post-landing  recovery,  and  was  planned  for  two  review  rounds 
and  an  optional  third  round  to  be  conducted  only  if  required.  The  initial  field  of 
invitations  included  twenty-two  individuals  from  various  organizations.  In  the  first 
round,  five  reviewers  responded.  The  second  round  review  was  only  sent  to  those 
individuals  who  responded  in  the  first  round.  Four  participants  responded  in  the  second 
round.  The  comments  in  the  second  round  prompted  significant  changes  to  the  model,  so 
the  optional  third  round  was  conducted,  with  two  participants  responding.  The  actual 
documents  reviewed  by  the  Delphi  panel  and  their  responses  can  be  viewed  in 
Attachment  1 .  The  names  of  participants  and  individual  responses  have  been  sanitized  to 
protect  the  integrity  and  professional  image  of  the  individual  in  accordance  with  Air 
Force  Institute  of  Technology  requirements  for  research  involving  human  subjects.  All 
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participants  signed  a  consent  form  whieh  explained  the  intent  and  conduct  of  the  Delphi 
process  prior  to  their  decision  to  participate. 

Comparison  to  Real  World  System 

The  RMLV  is  in  the  concept  phase,  so  no  real  world  system  exists  to  compare  the 
model  results  to,  however,  the  Space  Shuttle  orbiter  is  useful  as  a  surrogate  for  analysis. 
Using  the  orbiter  data  as  the  baseline  for  the  process  duration  distributions  in  the  model, 
and  then  eomparing  the  model  results  to  the  Spaee  Shuttle  orbiter  post-landing  recovery 
data  will  offer  the  best  validation  of  any  real  world  system.  The  model  was  run  with 
forty  replieations  to  produce  enough  data  to  develop  useful  statistics  for  the  comparison. 
The  basic  statistics  are  presented  in  Table  4.2  are  the  combined  results  from  the  forty 
replieations  for  comparison  to  the  Space  Shuttle  orbiter’ s  actual  post-landing  recovery. 


Mean 

3.4303  hours 

Standard  Error  Mean 

0.0358  hours 

Minimum 

3.0364  hours 

Median 

3.4052  hours 

Maximum 

3.9859  hours 

Standard  Deviation 

0.2265  hours 

Table  4,2:  Model  Total  Post-Landing  Recovery  Time 

The  histogram  in  Figure  4.1  illustrates  the  distribution  of  the  total  post-landing  recovery 
times  from  the  forty  replications  performed  for  validating  the  model. 


Histogram  of  Cl 

Normal 


Cl 

Figure  4,1:  Histogram  of  Model  Total  Post-Landing  Recovery  Time 
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Historically,  Space  Shuttle  orbiter  towing  operations  begin  within  four  hours  of  landing, 
and  are  complete  within  six  hours  of  landing.  Since  the  RMLV  is  expeeted  to  be  an 
unmanned  spacecraft,  the  time  required  to  serviee  the  flight  erew  for  the  orbiter  ean 
aceount  for  the  difference  in  the  total  duration  between  real  world  orbiter  post-landing 
recovery  operations  performanee  and  the  modeled  RMLV  post-landing  reeovery 
operation. 

Validation  Summary 

The  Delphi  proeess  used  in  this  researeh  was  the  most  important  validation  tool 
used  in  this  model.  The  insights  and  opinions  of  the  experts  participating  in  the  Delphi 
panel  greatly  shaped  the  construet  of  the  model.  The  seeondary  validation  of  comparing 
to  a  real-world  system,  while  effect  when  using  distributions  derived  from  data  collected 
on  that  real-world  system,  is  limited  in  that  it  eannot  aeeount  for  the  validity  of  the  model 
if  it  does  not  include  a  similar  design  to  the  Spaee  Shuttle  orbiter. 

Conclusions 

The  eonstruction  of  the  RMLV  post-landing  reeovery  process  model  revealed 
several  insights  to  help  guide  design  and  development.  In  general,  the  simplest  design, 
requiring  the  fewest  ground  erew  actions  and  ground  support  equipment  requirements 
will  produce  the  performanee  sought  by  the  Air  Foree.  Speeifics  related  to  these  design 
decisions  include  on-board  automation  of  sensors  and  specifie  shutdown  notions,  the 
elimination  of  time-oonsuming  ground  crew  notions  by  designing  the  RMLV  in  suoh  a 
way  that  it  does  not  require  special  handling  to  protect  its  components,  or  to  protect  the 
ground  erew  from  hazardous  situations  that  could  be  avoided  with  alternative  designs. 
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On-board  Automation 


The  automation  of  as  many  processes  as  practical  will  shorten  the  processing  time 
required  to  recover  the  RMLV.  As  observed  in  comparing  the  Space  Shuttle  orbiter  and 
F-16  processes  for  handling  hydrazine  powered  units,  using  automated  hazardous  gas 
detection  speeds  processing,  eliminating  minutes  from  the  recovery  process. 

Eliminating  Special  Handling  Requirements 

The  Space  Shuttle  orbiter  requires  significant  special  handling  to  protect  the  flight 
and  ground  crew  personnel  from  hazardous  materials.  In  particular,  hydrazine  and  its  by¬ 
products  are  dangerous  to  all  personnel.  In  the  orbiter  it  is  used  to  power  the  auxiliary 
power  unit,  and  on  the  F-16  it  is  used  to  power  the  emergency  power  unit.  The 
elimination  of  hazardous  materials  that  require  special  handling  will  significantly  reduce 
post-landing  recovery  time  for  the  RMLV.  In  the  NASA  root  cause  analysis  of  possible 
technical  changes  to  the  Space  Shuttle  system,  fuels  requiring  special  handling  were 
identified  as  a  cause  for  delays  in  processing  (McClesky,  2005:82). 

Simplicity 

Simplicity  in  design  and  processes  goes  hand-in-hand  with  the  other 
recommendations.  The  simpler  the  design,  such  as  exchanging  the  hydrazine  powered 
APU  with  a  battery  system,  will  often  drive  simpler  and  quicker  ground  processing. 
Additionally,  when  comparing  Space  Shuttle  orbiter  and  F-16  processes,  the  requirements 
for  the  purge  and  cooling  processes,  and  the  complexity  of  those  processes  adds 
considerable  time  to  the  processing  of  the  orbiter  (McClesky,  2005:82).  If  these 
processes  can  be  avoided,  the  RMLV  will  be  able  to  achieve  post-landing  recovery  times 
closer  to  the  F-16  process. 
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The  concept  of  simplicity  is  not  new,  in  independent  studies,  Air  Force  analysts 
developed  recommendations  for  simplicity  in  design  and  processes  for  space  launch 
systems  (London,  1994:96-102).  Simplicity  in  design  may  not  eliminate  the  requirement 
for  specific  processes,  but  may  make  servicing  the  design  simpler  and  faster,  reducing  the 
total  time  for  post-landing  recovery.  Also,  complexity  in  design  does  not  prevent  the 
processes  for  servicing  the  RMLV  from  remaining  simple.  The  F-16  offers  an  excellent 
example.  The  F-16  is  a  complex  system,  but  the  processes  required  for  post-landing 
recovery  are  simple  and  take  little  time  when  compared  to  the  processes  and  time 
required  to  conduct  post-landing  recovery  of  the  Space  Shuttle  Orbiter. 
Recommendations  for  Future  Research 

Three  recommendations  for  future  research  evolved  from  the  conduct  of  the 
research  for  the  creation  of  the  RMLV  post-landing  recovery  discrete-event  simulation 
model. 

First,  the  RMLV  ground  operations  model  which  is  the  compilation  of  the  model 
for  this  study  and  the  models  for  vehicle  maintenance  and  pre-launch  operations,  created 
by  Captains  Pope  and  Stiegelmeier  respectively,  should  be  combined  with  flight 
operations  models  that  evaluate  the  launch,  flight,  and  retum-to-base  for  the  RMLV.  The 
combined  flight  and  ground  operations  model,  constructed  with  the  level  of  detail  for  all 
phases  that  currently  exists  in  the  ground  operations  models,  while  complex,  will  aid 
RMLV  designers  to  fully  evaluate  the  impact  of  design  decisions  on  the  conduct  of  the 
entire  RMLV  mission. 

Second,  an  assumption  in  this  model  was  the  use  of  liquid  propellants  for  the  fist- 
stage  booster.  This  assumption  guided  the  development  of  the  model.  Another  option  is 
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the  use  of  solid  roeket  fuels  for  the  primary  booster.  The  use  of  solid  roeket  fuels  will 
dramatieally  alter  the  design  of  the  RMLV,  as  well  as  the  proeesses  required  to  serviee 
the  vehicle  in  post-landing  recovery,  maintenance,  and  pre-launch  operations.  The  basic 
concept  could  be  a  vehicle  package  that  includes  all  the  avionics  and  guidance  systems, 
and  the  aerodynamic  structures  required  to  accomplish  the  mission.  The  solid  fuels  could 
be  scalable  cartages  inserted  into  the  vehicle,  tailored  for  the  specific  mission.  A  solid 
rocket  design  could  simplify  many  ground  operations  processes,  but  will  also  have  to  be 
evaluated  against  flight  operations  requirements. 

Third,  cost  analysis  is  an  important  factor  in  evaluating  the  efficacy  of  any  design 
decision.  The  subject  model  for  this  study  did  not  address  cost  issues.  In  future  studies, 
the  impact  of  RMLV  design  decisions  to  the  cost  of  operations  should  be  incorporated 
into  the  model  to  provide  a  full  accounting  of  the  critical  factors  that  affect  any  design 
decision. 

Finally,  there  are  opportunities  for  investigating  the  methods  of  incorporating 
process  simplicity  and  efficiency  into  complex  systems.  When  comparing  the  Space 
Shuttle  orbiter  and  F-16  processes,  it  is  clear  that  some  processes  are  similar,  with  nearly 
identical  purposes,  but  vary  greatly  in  complexity  and  duration.  Researching  the  conduct 
of  critical  processes  in  the  context  of  RMLV  design  and  component  design,  can 
potentially  yield  significant  improvements  in  the  simplicity  and  duration  of  processes 
required  for  RMLV  regeneration. 

Summary 

The  purpose  of  this  study  was  to  develop  a  discrete-event  computer  simulation 
model  to  assist  the  Air  Force  Research  Laboratory,  Air  Vehicles  Directorate  in  the 
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evaluation  of  the  impaet  of  various  design  deeisions  on  the  time  to  perform  post-landing 
RMLV  reeovery  operations.  This  study  has  demonstrated  the  plaee  the  RMLV  eoneept 
holds  within  the  US  National  Spaee  Transportation  Poliey,  Air  Foree  doetrine,  and 
AFSPC  initiatives.  The  analysis  of  Spaee  Shuttle  orbiter  and  F-16  post-landing  reeovery 
operations  reveals  general  prineiples  designers  should  eonsider  when  eondueting 
produetion  runs  and  analysis  using  the  model  to  evaluate  design  alternatives.  The  final 
RMLV  design  will  have  to  meet  a  broad  range  of  requirements.  The  real  ehallenge  for 
designers  is  not  to  optimize  the  post-landing  reeovery  operation,  but  to  optimize  system 
performanee  aeross  all  phases  of  operation,  launeh,  flight  operations,  post-landing 
reeovery,  vehiele  maintenanee,  and  pre-launeh.  Design  deeisions  that  will  optimize  the 
post-landing  reeovery  operations  may  have  a  greater  negative  impaet  on  another 
operational  phase  than  the  positive  impaet  to  post-landing  reeovery.  Finally,  this  study 
eannot  answer  all  questions  regarding  the  best  approaeh  for  evaluating  design 
alternatives.  Future  researeh  should  evaluate  all  phases  of  operation,  eost,  and 
dramatieally  different  design  options  not  offered  in  this  study. 
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Attachment  1:  Delphi  Panel,  Round  1  Review  and  Responses 


REUSABLE  MILITARY  LAUNCH  VEHICLE  LOGISTICS: 
POST-LANDING  RECOVERY  OPERATIONS  MODEL 
DELPHI  PANEL  REVIEW  #1 


Delphi  Panel  Participants, 

Thank  you  for  your  willingness  and  time  to  participate  in  this  research  on  the 
post-landing  recovery  operations  model  for  the  Reusable  Military  Launch  Vehicle 
(RMLV).  In  the  following  pages  you  will  find  the  processes  and  flow  of  the  initial  model 
for  your  review.  Some  points  I  would  like  to  highlight  to  help  guide  your  analysis  of  the 
model  are  first,  this  model  is  only  intended  to  represent  the  processes  from  the  point  of 
wheels-stop  on  the  runway  to  the  end  of  towing  outside  the  vehicle  maintenance  facility. 
Second,  I  am  primarily  concerned  with  your  comments  regarding  the  following  issues: 

1 .  Are  the  processes  represented  appropriate? 

2.  Are  all  appropriate  processes  included  in  the  model? 

3.  Are  the  processes  represented  to  the  appropriate  level  of  detail? 

4.  Is  the  flow/order  of  the  processes  appropriate? 

5.  Are  parallel  processes  identified  appropriately? 

6.  Are  there  opportunities  to  consolidate  processes  in  the  model  and  still 

accurately  represent  the  system? 

Outside  of  these  primary  questions,  I  am  interested  in  any  other  comments  you  may  have 
regarding  this  effort,  but  only  your  comments  regarding  the  actual  model  will  be  used  in 
the  research. 

I  will  be  looking  for  responses  on  17  March  2006  with  the  intent  of  consolidating 
and  incorporating  comments  into  the  model  and  sending  out  a  second,  and  hopefully 
final,  model  for  your  review  by  3  April  2006.  As  a  final  note,  without  a  signed  informed 
consent  letter  I  cannot  include  your  comments  in  the  study,  so  please  send  a  signed  copy 
as  requested  in  the  email  accompanying  the  letter.  Thank  you  again  for  your  attention  and 
assistance  in  this  study  of  the  RMLV  post-landing  recovery  operations  model. 


Very  Respectfully, 

MICHAEL  MARTINDALE,  Major,  USAE 
Air  Eorce  Institute  of  Technology 
Department  of  Operational  Sciences 
Michael.martindale@afit.edu 
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Initial  Safiog  and  Safety  Assessment  Inspections 


Additional  Maintenance  Actions  to  Create  Safe  Environment  for  Ground  Crews,  and  Set¬ 
up  for  Preparing  RMLV  for  Transport  to  Maintenance  Facility 


Additional  MX,  if  required, 
and  APU  Shutdown 


Set-up  for  RMLV  transport  preparation 


Decision  mocule 

RMLV  passes 
safety  inspection, 
proceed  to  APU 
Shutdown,  eise 
send  to 
maintenance 
process  moduie 
representing 
additionai  MX 
actions  required  to 
make  RMLV  safe 
for  ground  crews. 


Process  moduies: 
Represents  actions 
required  to  set-up  for  and 
initiate  the  purge  of 
hazardous  gases 
assoc  ated  with  hypergoiic 
fueis.  These  steps  are 
skipped  if  design  does  not 
inciude  tjyBSjaate- 


Process  mocuie: 

Represents 
additional  actions 
required  to  prepare 
the  vehicle  for 
handover  to  ground 
control. 


Process  module: 

Represents  the 
Installation  of 
landing  gear  lock 
pins  and  vent 
plugs. 
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Incident  of  RMLV  landing  with  external  stores,  and  final  safety  call 


Actions  'equired  if  RMLV  lands  with  external  stores 


39fing  Sequence  and  Final  RMLV  Pre-Tow  Preparations 


SatUjg  Sequence 
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Completion  of  Cafing  Sequence,  Final  Tow  Preps,  and  RMLV  Towing 


SatlDS  Sequence  Continued 


Delphi  Panel  Participant  Comments  from  Round  1 


Reviewer  1: 

Comment:  “Pass  Safety  Assessment?”  If  you  are  doing  the  “Forward  Safety 
Assessments”  and  “Aft  Safety  Assessments”  prior  to  Node  1  (before  the  Fwd  and  Aft 
assessment  are  batehed)  would  you  do  this  pass  test  deeision  then  and  for  eaeh  parallel 
process?  If  not  then  you  might  be  waiting  unnecessarily  to  start  the  additional 
maintenance  for  the  failed  assessment. 

Action:  I  am  operating  on  the  assumption  that  the  entire  safety  assessment  must  pass 
before  proceeding  with  additional  recovery  actions.  Part  of  my  reasoning  is  based  on  the 
absence  of  a  crew  which  would  force  urgency  in  proceeding,  as  it  is,  the  ground  crew ’s 
safety  is  the  primary  concern.  If  my  reasoning  is  predicated  on  a  false  assumption,  then 
please  let  me  know  and  the  model  can  be  changed. 

Comment:  You  might  consider  putting  the  “Pass  Safety  Assessment?”  and  “MX  Delay 
Safety  for  Haz  Gas  in  a  loop  back  to  before  the  decision  block.  The  reason  for  this  is  that 
the  Mx  process  may  not  fix  the  safety  concern  or  could  possibly  cause  some  additional 
safety  concerns  (Maintenance  induced  failure)  that  would  need  to  be  addressed.  In  the 
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“MX  Delay  for  Haz  Gas”  block,  is  hazardous  gas  the  only  safety  concern  that  would 
cause  a  failed  safety  assessment? 

Action:  Incorporated  into  the  model. 

Comment:  If  the  booster  returns  with  the  payload,  would  this  require  a  possible  path  and 
decision  in  the  model  where  the  vehicle  may  need  to  be  towed  to  the  integration  facility? 

Action:  This  is  a  critical  system  design  consideration  I  had  not  thought  of  prior. 
Essentially,  it  is  the  tradeoffs  between  designing  and  building  equipment  to  remove  and 
handle  the  payload  on  the  runway  as  a  part  of  recovery  versus  using  the  integration 
facility  at  the  expense  of  using  the  facility  to  prepare  a  separate  RMLV  and  payload  for 
launch.  From  a  modeling  perspective  this  is  fairly  easy  to  incorporate,  but  really  it  is  a 
larger  system  design  issue.  I  am  interested  in  others  comments  regarding  system  design. 
Either  way  of  removing  the  payload  in  this  contingency  will  work,  perhaps  the  model 
needs  options  to  do  it  either  way,  on  the  runway  using  specialized  GSE,  or  in  the 
integration  facility.  Comments? 

Comment:  How  is  the  “Drag  Chute  Pyro  Safing”  in  the  Safing  Sequence  different  than 
the  “Drag  Chute  Safing”  during  the  initial  Safing  Processes? 

Action:  Incorporated  into  the  model. 

Comment:  I’m  not  100%  sure  but  I  think  that  Hydrozine  is  a  Hypergol.  Shouldn’t  this 
have  been  safed  prior  to  Node  2  or  at  least  have  a  decision  block  around  this  if  Hypergols 
are  not  used? 

Action:  Incorporated  into  the  model. 

Reviewer  2: 

Comment:  RJDs  will  most  likely  be  required  for  any  reentry  vehicle,  should  assume  they 
are  there. 

Action:  Incorporated  into  the  model. 

Comment:  If  non-toxic  fuels  for  RJD  (peroxide),  then  safe  but  no  ground  assessment 
required.  If  toxic  fuels,  then  safe  and  ground  assess  for  0  toxic  residuals/leaks. 

Action:  Incorporated  into  model  and  discussion. 

Comment:  APU  for  Shuttle  powers  hydraulics  for  flight  controls,  if  that  module  is 
intended  to  pertain  to  flight  controls,  it  should  be  powered  down. 

Action:  Incorporated  into  discussion. 
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Comment:  Electrical  power  for  avionics  is  from  fuel  cells,  should  remain  powered  thru 
total  safmg.  Generally,  some  form  of  GSE  cooling  would  be  required  while  powered. 

Action:  Incorporated  into  discussion. 

Comment:  Vehicle  purge  is  for  both  toxics  and  explosives.  Accumulations  of  oxidizers, 
fuels  or  toxics  could  pose  a  hazard  to  the  vehicle/gnd  personnel. 

Action:  Incorporated  into  model  and  discussion. 

Comment:  Purge  on  the  Shuttle  is  also  for  structural  cooling  post  reentry,  life  cycle  issue 
with  the  structure. 

Action:  Incorporated  into  discussion. 

Comment:  As  I  mentioned  earlier,  gnd  cooling  is  for  avionics  which  remain  powered 
during  gnd  operations. 

Action:  Incorporated  into  discussion. 

Reviewer  3: 

Comment:  Does  the  safing  sequence  include  the  time  it  might  take  people  to  get  to  the 
vehicle? 

Action:  Yes,  based  on  the  assumption  that  the  entire  ground  crew  is  ready  and  in  position 
at  wheels  stop  and  begin  approaching  the  vehicle  after  it  passes  safety  assessment. 

Comment:  What  does  “MX”  mean?  Maintenance? 

Action:  Yes. 

Comment:  Tow  preps  could  be  expanded  a  little  more  -  bring  out  vehicle  for  towing, 
attach  to  RMLV,  check  connection,  etc. 

Action:  Incorporated  into  the  model. 
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Reviewer  4: 


Comment:  No  comments. 


Action:  None. 


Reviewer  5: 

Comment:  From  our  phone  conversation  it  looks  like  the  overall  flow  diagrams  are 
correct. 


Action:  None. 
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REUSABLE  MILITARY  LAUNCH  VEHICLE  LOGISTICS: 
POST-LANDING  RECOVERY  OPERATIONS  MODEL 
DELPHI  PANEL  REVIEW  #2 


Delphi  Panel  Partieipants, 

Thank  you  for  your  continued  willingness  to  participate  in  this  research  on  the 
post- landing  recovery  operations  model  for  the  Reusable  Military  Launch  Vehicle 
(RMLV).  In  the  following  pages  you  will  find  the  processes  and  flow  of  the  model 
modified  based  on  your  comments  from  the  first  review.  As  a  reminder,  this  model  is 
only  intended  to  represent  the  processes  from  the  point  of  wheels-stop  on  the  runway  to 
the  end  of  towing  outside  the  vehicle  maintenance  facility.  Second,  I  am  primarily 
concerned  with  your  comments  regarding  the  following  issues; 

1 .  Are  the  processes  represented  appropriate? 

2.  Are  all  appropriate  processes  included  in  the  model? 

3.  Are  the  processes  represented  to  the  appropriate  level  of  detail? 

4.  Is  the  flow/order  of  the  processes  appropriate? 

5.  Are  parallel  processes  identified  appropriately? 

6.  Are  there  opportunities  to  consolidate  processes  in  the  model  and  still 

accurately  represent  the  system? 

7.  Were  your  previous  comments  accurately  incorporated  into  the  model? 

Outside  of  these  primary  questions,  I  am  still  interested  in  any  other  comments  you  may 
have  regarding  this  effort,  but  only  your  comments  regarding  the  actual  model  will  be 
used  in  the  research. 

I  will  be  looking  for  responses  on  20  April  2006.  This  is  intended  to  be  the  final 
review,  however,  if  there  are  significant  issues  with  the  model  a  third  review  may  be 
required.  I  have  received  informed  consent  from  most  of  you,  and  I  owe  further  contact 
information  to  those  who  have  not  sent  it  yet,  look  for  the  information  on  your  email.  I 
am  a  student  with  knowledge  of  modeling  and  space  operations,  but  with  no  real  practical 
experience  in  this  area,  so  I  thank  each  of  you  for  the  benefit  of  your  knowledge  and 
effort  in  supporting  me  in  my  research  to  build  the  RMLV  post-landing  recovery 
operations  model. 


Very  Respectfully, 

MICHAEL  MARTINDALE,  Major,  USAF 
Air  Force  Institute  of  Technology 
Department  of  Operational  Sciences 
Michael.martindale@afit.edu 
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Initial  Sating  and  Safety  Assessments 


Maintenance  Actions  Required  to  Prepare 
RMLV  for  Transportation 
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Incident  of  RMLV  Landing  with  External 

Stores 


Final  Safety  Call 
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Safing  Sequence 


Process  Modules:  Represent  actions 
required  to  complete  siting  of  the  RMLV 
for  transportation  and  entry  into  the 
maintenance  facility. 


RMLV  Preoaration  for  Transportation 
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Final  Tow  Preparations 


Towing  Operations 
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Delphi  Panel  Participant  Comments  from  Round  2 


Reviewer  1: 

Comment :  If  you  have  a  problem  with  hypergolie  leaks  -  why  would  you  want  the  APU 
to  eontinue  to  run  until  maintenanee  aetions  are  eomplete? 

I  don’t  know  how  the  F-16  operates  their  hydrazine  APU  but  for  the  shuttle  orbiter,  there 
is  only  a  limited  supply  of  fuel  on  board  and  the  APU  system  is  no  longer  needed  after 
wheels  stop.  The  APU  system  would  also  be  one  of  the  primary  leak  loeations  eausing 
the  anomaly  in  the  first  plaee.  I  would  suggest  the  proper  sequenee  would  be  to  move  the 
APU  shutdown  just  after  wheels  stop  before  any  ground  personnel  approach.  You  would 
still  have  electrical  power  from  batteries  or  fuel  cells  to  monitor  the  flight  systems  and 
down  load  any  health  management  data  for  the  ground  crew. 

The  Does  Design  include  Hypergols  block  and  forward  and  aft  assessment  blocks  would 
remain  the  same  just  move  shutdown  APU  between  Wheels  stop  and  Reaction  Jet  and 
Drag  chute  Safmg  (or  between  Safmg  block  and  Does  Design  include  blocks). 

Action:  Incorporated  comment  in  to  the  model  by  moving  the  APU  shutdown  process  as 
recommended. 

Comment:  Page  2  contains  a  lot  of  work  that  adds  significant  time  to  this  process  for  the 
sole  purpose  of  giving  you  more  time  to  work  on  the  vehicle  on  the  runway.  If  the  vehicle 
were  capable  of  self  assessment  for  leaks  and  capable  of  self  taxi  to  the  maintenance 
hanger  (UAV’s  can  do  this  today)  why  stop  and  connect  purges  and  coolant  loops  that 
now  become  part  of  a  convoy  for  moving  the  vehicle  to  the  maintenance  bay?  The 
vehicle  purge  on  the  shuttle  orbiter  is  required  because  the  thermal  tiles  radiate  heat  in  all 
directions  (equally  into  the  wing  box  and  to  the  outside)  and  the  orbital  frame  is  low  temp 
aluminum  -  the  wing  box  would  yield  if  the  orbiter  sat  too  long  after  re-entry  without  a 
purge  to  carry  the  heat  away.  If  you’ve  got  high  temperature  skin  and  hot  structure 
underneath,  I  suspect  you  would  not  need  a  vehicle  purge  on  the  runway.  It  depends  on 
your  thermal  load  (flight  profile)  and  the  TPS/wing  structure  materials.  You  may  want  a 
vehicle  purge  as  it  gets  close  to  the  maintenance  bay  for  a  final  purge  of  noxious  gases 
but  try  to  eliminate  the  convoy  option.  You  may  want  to  add  a  couple  of  if/then  branches 
for  hot  structure  yes  proceed  to  lock  pin  insertion,  no,  hook  up  vehicle  purge.  The  same 
for  ground  cooling:  If  Avionics  and  fuel  cells  require  active  cooling  within  30  minutes, 
then  hook  up  coolant  loop,  if  no,  proceed  to  lock  pin  insertion. 

Action:  Decision  modules  added  to  the  model  to  allow  for  inclusion  of  hot  structures  and 
safety  self-assessments  on  the  RMLV. 

Comment:  Before  the  ‘ready  for  downgrade  decision  block’  need  to  address  the  safing  of 
the  LOX  tank  on  board.  This  block  appears  to  be  later  in  the  Safing  sequence  -  you  may 
not  have  that  long. 
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Liquid  Oxygen  (LOX)  is  a  cryogenic  fluid  (very  cold  liquid)  that  wants  desperately  to 
return  to  it’s  natural  gaseous  state  and  atmospheric  pressure  and  temperature.  Any  LOX 
left  over  in  the  propellant  tank  after  rocket  engine  shutdown  will  begin  to  warm  up  and 
pressurize  the  flight  tank  until  the  tank  no  longer  contains  liquid  and  the  ullage  gas  and 
tank  warms  up  to  ambient  temperature.  Active  cycling  of  the  tank  vent  valve  or  relief 
valve  will  be  necessary  to  control  this  rising  pressure  in  the  tank.  During  the  flight  to  the 
landing  area,  the  left  over  LOX  should  be  drained  to  the  atmosphere.  This  becomes  rather 
tricky  in  that,  the  flight  propellant  tanks  are  typically  pressure  stabilized  tank  to  handle 
flight  structural  loads  so  dropping  the  pressure  too  far  will  result  in  a  very  bad  day.  The 
most  probable  scenario  this  vehicle  will  have  to  deal  with  is  the  venting  of  the  tank  at 
least  once  after  wheels  stop  and  close  monitoring  of  the  tank  until  the  vehicle  can  be 
drained  and  purged.  This  will  probably  be  done  in  the  maintenance  facility  or  an 
intermediate  sating  facility  between  the  runway  and  maintenance  hanger.  The  shuttle 
does  not  have  to  deal  with  this  per  se;  The  propellant  tanks  are  disposable  (the  External 
Tank)  that  breaks  up  and  falls  into  the  Indian  Ocean  after  main  engine  cut-off.  100% 
oxygen  environment  can  be  very  dangerous  with  hot  things  in  close  proximity;  we’ve 
burned  a  few  cars  to  the  ground  because  of  an  oxygen  rich  atmosphere  so  the  safety 
convoy  will  have  to  be  careful. 

Action:  LOX safing  actions  incorporated  into  the  model. 

Comment:  In  the  sating  sequence  you  have  ‘record  fuel  cell  pressures’  Running  fuel  cells 
will  be  adding  a  lot  of  heat  internal  to  the  vehicle  -  driving  the  need  for  the  ammonia 
cooling  system  in  item  2  above.  If  you  could  get  the  vehicle  on  ground  power  as  soon  as 
possible  after  wheels  stop,  this  could  take  another  element  of  a  long  initial  sating  period 
out  of  the  equation.  Think  of  an  airliner  pulling  into  the  gate,  switching  to  ground  power 
and  shutting  down  the  APU’s  and  engines  quickly.  Also,  this  vehicle  may  be  using 
batteries  instead  of  fuel  cells  (less  than  an  hours  flight  time  from  T-0,  probably  should 
account  for  both  scenarios  -  if  fuel  cells  used,  etc. 

Action:  Incorporated  decision  module  to  determine  need  for  cooling  based  on  existence 
of fuel  cells.  This  will  be  reflected  in  the  GUI  coding  for  the  user. 

Comment:  Under  RMLV  Prep  for  Transport: 

a.  Leave  TPS  inspection  and  debris  inspection  blocks  for  the  maintenance 
hanger  activity.  May  want  to  add  a  preliminary  inspection  block  on  first 
page  but  this  should  not  be  a  long  or  detailed  inspection  -  just  looking  for 
gross  damage  or  something  leaking  on  the  ground. 

b.  Same  with  protective  cover  inspection,  why  bring  out  service  platforms 
out  on  to  the  runway  when  you  could  install  them  as  soon  as  your  in  the 
maintenance  bay  where  all  you  access  platforms  are  already  staged. 

c.  I  don’t  understand  the  vacuum  vent  duct  inerting.  Vacuum  inerting  of 
the  Orbiter  MPS  system  is  done  on  orbit  to  the  vacuum  of  space  where 
there  is  no  delta  pressure  to  cause  damage  to  flight  weight  systems  and  the 
propellant  residuals  can  evaporate  or  sublimate  to  space  safely.  If  you  are 


60 


looking  to  safe  the  LOX  propellant  system,  you  would  typieally  purge 
your  oxygen  system  with  gaseous  nitrogen.  Again  I  don’t  think  this  would 
be  done  on  the  tarmac  but  rather  at  a  safing  station  later  in  the  flow  or  as 
soon  as  it  is  connected  inside  the  maintenance  facility. 

Action:  Incorporated  decision  modules  to  give  designers  options  regarding  protective 
covers  and  vacuum  ducting.  Reflected  the  superficial  nature  of  the  TPS  and  debris 
inspections  as  was  originally  intended. 

Comment:  Overall,  I  think  you’re  doing  a  very  good  job  capturing  all  the  things  that  need 
to  be  addressed  on  the  tarmac  before  the  vehicle  heads  to  the  maintenance  facility.  Keep 
in  mind  your  model  will  eventually  be  used  to  help  drive  the  design  of  the  vehicle  itself 
so  your  model  needs  to  ask  a  lot  of  ‘if  vehicle  uses  hypergols’  or  ‘if  vehicle  uses  fuel 
cells’  type  questions  so  that  the  designer  knows  he  pays  a  penalty  in  turnaround  time  if 
his  vehicle  is  too  complex.  The  simplest  vehicle  that  we’ve  been  able  to  imagine  is  one 
that  a  pair  of  technicians  could  approach  with  a  tug  and  be  notified  on  their  laptop  or 
radio  that  it’s  safe  to  approach.  They  put  in  the  gear  locking  pins,  hook  up  the  tow  bar 
and  ground  power  and  data  cables  to  the  front  wheel  well  and  pull  the  vehicle  to  a  safing 
station  between  the  runway  and  maintenance  facility  for  purge  and  inerting  of  the  LOX 
tank.  The  vehicle  would  go  on  external  power  from  the  tug  as  soon  as  it’s  hooked  up. 
APU’s  would  be  shut  down  automatically  at  wheels  stop  and  fuel  cells,  if  used,  would  be 
shut  down  as  soon  as  ground  power  established.  The  vehicle  should  be  on  the  move  in 
less  than  5  minutes  from  wheels  stop.  The  more  complex  the  vehicle,  the  more  time, 
people  and  support  vehicles  are  needed  to  make  it  safely  to  the  maintenance  hanger. 
That’s  what  your  model  will  show  the  designers. 

Action:  None. 

Reviewer  2:  First  round  comment: 

“If  the  booster  returns  with  the  payload,  would  this  require  a  possible  path  and 
decision  in  the  model  where  the  vehicle  may  need  to  be  towed  to  the  integration 
facility?” 

Your  action  mentions  a  critical  system  design  and  this  is  something  I  did  not  consider  but 
it  seems  as  though  this  step  might  be  moot.  Since  we  are  currently  concerned  with  a 
hybrid  launcher  (Expendable  upper  stage)  just  the  booster  should  be  modeled  for 
turnaround.  This  said  the  booster  will  never  return  with  a  payload.  To  accommodate  this 
capability,  the  booster  would  have  to  be  designed  to  land  with  the  payload  which  would 
drive  the  weight  and  size  of  the  vehicle  up  which  will  negatively  impact  the  life  cycle 
costs.  This  payload  removal  step  would  most  likely  come  into  play  for  a  reusable  upper 
stage  but  this  probably  will  not  be  considered  until  after  a  hybrid  launcher  is  flying. 
Action:  RMLV design  is  still  in  its  infancy,  so  the  model  now  includes  a  decision  module 
that  will  give  designers  the  option  to  make  the  RMLV  capable  of  returning  with  external 
stores  should  it  experience  some  type  of  contingency,  or  not  have  the  capability  based  on 
size  and  complexity  limitations. 
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Reviewer  3:  No  eomments. 


Reviewer  4:  No  eomments. 
Reviewer  5:  No  eomments. 


NOTE:  Reviewer  number  designations  are  not  eonsistent  between  reviews  to  ensure 
anonymity. 
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REUSABLE  MILITARY  LAUNCH  VEHICLE  LOGISTICS: 
POST-LANDING  RECOVERY  OPERATIONS  MODEL 
DELPHI  PANEL  REVIEW  #3 


Delphi  Panel  Participants, 

Let  me  start  by  saying  thank  you  once  again  for  your  willingness  to  participate  in 
this  research  on  the  post-landing  recovery  operations  model  for  the  Reusable  Military 
Launch  Vehicle  (RMLV).  In  the  following  pages  you  will  find  the  processes  and  flow  of 
the  model  modified  based  on  comments  from  the  second  review.  Originally  I  planned  on 
only  two  reviews,  however  some  important  comments  came  in  the  second  review  that 
necessitated  a  third  round.  Unfortunately,  the  third  round  must  be  abbreviated  with  regard 
to  time.  I  understand  that  I  have  asked  a  lot  from  the  participants  and  respect  the  fact  you 
may  no  longer  have  time  to  commit  to  this  project.  If  that  is  the  case  please  simply 
provide  a  negative  reply  via  email.  If  you  can  commit  just  a  little  more  time,  please 
review  the  process  flows  below  and  provide  any  additional  comments.  The  purpose  is  the 
same  as  earlier  reviews,  to  answer  the  following  questions; 

1 .  Are  the  processes  represented  appropriate? 

2.  Are  all  appropriate  processes  included  in  the  model? 

3.  Are  the  processes  represented  to  the  appropriate  level  of  detail? 

4.  Is  the  flow/order  of  the  processes  appropriate? 

5 .  Are  parallel  processes  identified  appropriately? 

6.  Are  there  opportunities  to  consolidate  processes  in  the  model  and  still 

accurately  represent  the  system? 

7.  Were  your  previous  comments  accurately  incorporated  into  the  model? 

The  most  recent  changes  reflect  additional  design  decisions  not  previously  considered 
(highlighted  in  blue),  but  do  not  significantly  change  the  content  of  the  model.  The  design 
decisions  will  allow  some  portions  of  the  processes  to  be  by-passed  if  appropriate. 

As  I  said  before,  the  timelines  are  compressed  for  this  review,  so  I  will  be  looking 
for  comments  or  negative  replies  no  later  than  1 1  May.  This  will  allow  me  time  to 
incorporate  your  comments  and  complete  the  verification  of  the  changes  in  the  model  on 
time  for  project  completion.  Thank  you  for  in  supporting  me  in  my  research. 


Very  Respectfully, 

MICHAEL  MARTINDALE,  Major,  USAF 
Air  Force  Institute  of  Technology 
Department  of  Operational  Sciences 
Michael.martindale@afit.edu 
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Landing,  Taxi,  and  Initial  Safing 


Process  Module: 
Added  to  represent 
LOX  safing  process. 


Uidiig  WU«k 
o6p 


): 


APUSlitkxri 

'  1 

Process  Module: 
Added  to  represent 
RMLV  taxi  to  apron  off 
the  runway,  similar  to 
aircraft  operations. 


Process  Module: 

Represents  RJD 
and  Drag  Chute 
sgfing.  to  include 
drag  chute  pyroJS- 


Decision  Module: 
Allows  designers  to 
consider  impact  of 
automated  APU 
shutdown  after 
landing  and  taxi. 
Process  Module: 
Represents  manual 
APU  shutdown 


Decision  Module: 
Allows  designers  to 
consider  impact  of 
using  non-toxic  fuels. 


Safety  Assessment 


Process  Module: 
Represents  ground 
crew  receiving 
safety  assessment 
data  from  RMLV. 


Decision  Module:  Allows 
designers  option  to 
make  Hazard  Gas 
detection  integral  to 
RMLV  design, 
eliminating  requirement 
to  have  detection  GSE. 


Represents  actions  taken 
to  assess  vehicle  safety  if 
detection  is  not  integral 
to  RMLV  design. 


Decision  Module:  Ground 


crew  determines  safety 
assessment  results  and 
either  continues  with 
recovery  or  conducts 
maintenance  to  achieve 
safe  conditions. 


Process  Module: 


Represents 
additional  actions 
required  prior  to 
handing  over  to 
ground  control. 
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Maintenance  Actions  Required  to  Prepare 
RMLV  for  Transportation 


Decision  Modules: 
Represent  design  options 
to  accommodate 
potential  for  non- 
hazardous  gas  design 
and  a  design  that 
includes  hot  structures 
that  do  not  require 
external  cooling  after 
landing. 


Process  Modules 
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Represent  actions 
required  to  position 
GSE  and  conduct 
purges  and  cooling, 
as  well  as  additional 
actions  to  prepare 
RMLV  to  continue 
with  the  recovery 
process. 


External  Stores  and  Final  Safety  Call 


Allows  for  design 
option  to  allow 
RMLV  to  return 
with  external 
stores 


Allows  for 
contingency  of 
RMLV  returning 
with  external 
stores. 

Process  Modules: 

Represent  actions 
to  position  GSE 
and  remove 
external  stores. 


Decision  Module:  If  “yes” 
RMLV  is  ready  for  total 
downgrade,  send  to 
parallel  processes  for  final 
satins  sequence  and  final 
maintenance  processes,  if 
“no”  then  RMLV  goes  to 
process  module  for 
additional  maintenance  to 
prepare  RMLVfortotal 
downgrade. 
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RMLV  Preparation  for  Transportation 


(I> 


SKidftSam^ 
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9»i<st>vacMffl 

Him  vaciira 

MitOictiHfVtg 

Allow  designers  to 
develop  RMLV  that 
does  not  require 
vacuum  duct 
inerting  or  the 
installation  of 
protective  covers 
for  towing 
operations. 


Process  Modules: 

Represent  actions 
required  to  conduct 
vacuum  duct 
inerting  and  install 
protective  covers,  if 
required.  Also 
actions  to  position 
tow  tug  and  on¬ 
board  systems 
monitoring. 


Safing  Sequence 
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Final  Tow  Preparations 
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Towing  Operations 


Process  Module: 
Represent  actions 
required  to  tow  the 
RMLVto  the 
maintenance 
facility. 


Record  Module: 

Records  time  of 
arrival  for  the  RMLV 
at  the  maintenance 
facility  for  later 
statistical  analysis. 

RHLVeiitblix 


Dispose  Module: 
Completes  the  model.  In 
final  work  this  module  is 
not  included  so  that  the 
model  can  become  a  part 
of  the  larger  model  for  the 
entire  processes  to  return 
the  RMLV  to  space. 


Delphi  Panel  Participant  Comments  from  Round  3 
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Attachment  2:  STS-1 14  S0028  Shuttle  Landing  Runway  Ops 


69 


ccMTAcr  aiiKxijRfe  l  aiia  imiosMcc 


References 


Air  Force  Doctrine  Document  1 .  Air  Force  Basic  Doctrine.  17  November  2003. 

Arena  7.01  Software  Help  module. 

Banks,  Jerry,  Carson,  John  S.  II,  Nelson,  Barry  L.,  and  Nieol,  David  M..  Discrete-Event 
System  Simulation,  Fourth  Edition.  New  Jersey:  Prentiee  Hall,  2005. 

Brown,  Kendall  K..  “A  Coneept  of  Operations  and  Technology  Implications  for 

Operationally  Responsive  Space.”  Air  <&  Space  Power  Chronicles  -  Chronicles 
Online  Journal.  June  1,2004. 

Carson,  John  S.  II.  Introduction  to  Modeling  and  Simulation.  Proceedings  of  the  2005 
Winter  Simulation  Conferenee,  M.  E.  Kuhl,  N.  M.  Steiger,  F.B.  Armstrong,  and  J. 
A.  Joines,  editors. 

Cebrowski,  Arthur  K.,  and  Raymond,  John  W..  “Operationally  Responsive  Space:  A 
New  Business  Model.”  Parameters.  US  Army  War  College  Quartery,  Summer 
2005. 

Delphi  Method,  www.iit.edu/~it/delphi.html  (5/9/2006) 

Department  of  Defense.  Verification,  Validation  and  Accreditation  (VV&A) 

Recommended  Practices  Guide.  Office  of  the  Direetor  of  Defense  Research  and 
Engineering,  Defense  Modeling  and  Simulation  Office.  November,  1996 

Isakowitz,  Steven  J.,  Hopkins,  Joshua  B.,  Hopkins,  Joseph  P.  Jr.  International  Reference 
Guide  to  Space  Launch  Systems  (4*^  Edition),  Reston,  VA:  American  Institute  of 
Aeronautics  and  Astronautics,  2004. 

Eondon,  John  R.  III.  LEO  on  the  Cheap:  Methods  for  Achieving  Drastic  Reductions  in 
Space  Launch  Costs.  Research  Report  No.  AU-ARI-93-8.  Maxwell  Air  Force 
Base,  Alabama:  Air  University  Press,  1994. 

Keohler,  Abby,  2"‘^  Eieutenant,  F-16  maintenance  offieer.  Personal  email. 

Kirk,  Timothy,  Major,  former  F-16  maintenance  offieer.  Personal  email. 

MaeMillan,  D.  C.  and  Marshall,  K..  “The  Delphi  proeess  -  an  expert-based  approaeh  to 
eeological  modeling  in  data-poor  environments.”  Animal  Conservation,  9  (2006). 
The  Zoologieal  Society  of  Eondon,  2005. 

MeCleskey,  Carey  M..  Space  Shuttle  Operations  and  Infrastructure: A  Systems  Analysis 
of  Design  Root  Causes  and  Effects.  National  Aeronautics  and  Space 
Administration,  Kennedy  Space  Center,  Florida:  2005.  NASA/TP — 2005-211519 

NASA  Faets.  “Eanding  the  Space  Shuttle  Orbiter.”  National  Aeronautics  and  Space 
Administration,  John  F.  Kennedy  Spaee  Center.  FS-2000-05-30-KSC. 


70 


Pope,  John  T.  III.  Discrete  Event  Simulation  Model  of  the  Ground  Maintenance 
Operations  of  a  Reusable  Military  Launch  Vehicle.  MS  Thesis, 
AFIT/GLM/ENS/06-14.  Graduate  School  of  Engineering  and  Management,  Air 
Eorce  Institute  of  Technology  (AU),  Wright-Patterson  Air  Eorce  Base,  Ohio,  March 
2006. 

Stewart,  Pamela,  Colonel,  USAE.  Operationally  Responsive  Spacelift  (ORS).  Air  Eorce 
Space  Command  briefing,  2003.  www. aero¬ 
space. nasa.gov/tgir/2003/ppt/stewart/stewart.pdf  (5/19/2006) 

Stiegelmeier,  Adam  T..  A  Discrete-Event  Simulation  Model  for  Evaluating  Air  Force 
Reusable  Military  Launch  Vehicle  Prelaunch  Operations.  MS  Thesis, 
AEIT/GLM/ENS/06-16.  Graduate  School  of  Engineering  and  Management,  Air 
Eorce  Institute  of  Technology  (AU),  Wright-Patterson  Air  Eorce  Base,  Ohio,  March 
2006. 

T. O.  1E-16CG-6WC-1-1 1 .  Combined  Preflight/Postflight/Alert  Preflight,  End-of- 

Runway,  Thruflight,  Launch  and  Recovery /Alert  Recovery,  Alert  Launch,  Basic 
Postflight,  and  Walkaround  Before  First  Flight  of  Day  Inspection  Work  Cards. 
USAE  Series.  E-16C/D  Aircraft,  using  El  lO-GE-lOO/lOOB  Engine,  Block  40. 

Tour,  Kennedy  Space  Center.  11-12  May  2006. 

U. S.  Space  Transportation  Policy.  January  6,  2005.  Eact  Sheet. 

Wood,  Casey  B..  Personal  email. 


71 


Vita 


Major  Michael  Martindale  graduated  high  school  from  St.  Johns  High  School  in 
St.  Johns,  Michigan.  He  earned  his  bachelor’s  of  Science  degree  at  the  United  States  Air 
Foree  Academy,  Colorado,  and  a  Master’s  of  Science  degree  in  Spaee  Studies  from  the 
University  of  North  Dakota. 

Major  Martindale  has  served  as  a  space  operations  officer  at  the  4**^  Space 
Warning  Squadron,  Holloman  AFB,  New  Mexico,  and  as  a  missile  launeh  officer  at 
Minot  AFB,  North  Dakota.  He  is  a  graduate  of  the  Air  Foree  Weapons  School  at  Nellis 
AFB,  Nevada  where  he  also  served  as  a  weapons  instructor.  Major  Martindale  was  then 
assigned  to  Headquarters  Air  Force,  Directorate  of  Operations  and  Training,  Checkmate 
Division,  Pentagon.  His  deployments  include  support  to  major  exercises  in  South  Korea, 
A1  Udeid  Air  Base,  Qatar  in  support  of  Operation  Enduring  Freedom  in  2001,  and  in 
again  in  support  of  Operation  Iraqi  Freedom  in  2004.  In  May  of  2005,  he  was  assigned  to 
the  Air  Foree  Institute  of  Teehnology  where  he  earned  his  master’s  degree  in  Logisties 
Management.  Upon  graduation  he  will  be  assigned  to  the  Air  Force  Element,  Joint 
Chiefs  of  Staff,  Pentagon. 


72 


REPORT  DOCUMENTATION  PAGE 

Form  Approved 

OMB  No.  074-0188 

The  public  reporting  burden  for  this  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources, 
gathering  and  maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  the  collection  of 
information,  including  suggestions  for  reducing  this  burden  to  Department  of  Defense,  Washington  Headquarters  Services,  Directorate  for  Information  Operations  and  Reports  (0704-0188), 

1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington,  VA  22202-4302.  Respondents  should  be  aware  that  notwithstanding  any  other  provision  of  law,  no  person  shall  be  subject  to  an 

penalty  for  failing  to  comply  with  a  collection  of  information  if  it  does  not  display  a  currently  valid  0MB  control  number. 

PLEASE  DO  NOT  RETURN  YOUR  FORM  TO  THE  ABOVE  ADDRESS. 

1.  REPORT  DATE  (DD-MM-YYYY) 

2.  REPORT  TYPE 

3.  DATES  COVERED  (From  -  To) 

08-06-2006 

Graduate  Research  Project 

May  2005  -  June  2006 

4.  TITLE  AND  SUBTITLE 


5a.  CONTRACT  NUMBER 


A  DISCRETE-EVENT  SIMULATION  MODEL  FOR  EVALUATING  AIR 
FORCE  REUSABLE  MILITARY  LAUNCH  VEHICLE  POST-LANDING 
OPERATIONS 


5b.  GRANT  NUMBER 


5c.  PROGRAM  ELEMENT  NUMBER 


6.  AUTHOR(S) 


MICHAEL  J.  MARTINDALE,  Major,  USAF 


5d.  PROJECT  NUMBER 


5e.  TASK  NUMBER 


7.  PERFORMING  ORGANIZATION  NAMES(S)  AND  ADDRESS(S) 

Air  Force  Institute  of  Technology 

Graduate  School  of  Engineering  and  Management  (AFIT/EN) 
2950  Hobson  Street,  Building  642 
WPAFB  OH  45433-7765 


9.  SPONSORING/MONITORING  AGENCY  NAME(S)  AND  ADDRESS(ES) 

AFRL/VAOT 

Attn:  Mr.  Bruce  Thieman 

2130  8*  Street  DSN:  785-5162 

WPAFB  OH  45433  e-mail:  bruce.thieman@wpafb.af  mil 


12.  DISTRIBUTION/AVAILABILITY  STATEMENT 

APPROVED  FOR  PUBLIC  RELEASE;  DISTRIBUTION  UNLIMITED. 


5f.  WORK  UNIT  NUMBER 


8.  PERFORMING  ORGANIZATION 
REPORT  NUMBER 

AFIT/ILM/ENS/06-09 


10.  SPONSOR/MONITOR'S  ACRONYM(S) 


11.  SPONSOR/MONITOR'S  REPORT 
NUMBER(S) 


14.  ABSTRACT 

The  purpose  of  this  research  was  to  develop  a  discrete-event  computer  simulation  model  of  the  post-landing  vehicle  recovery 
operations  to  allow  the  Air  Force  Research  Laboratory,  Air  Vehicles  Directorate  to  evaluate  design  and  process  decisions  and  their 
impact  on  RMLV  regeneration  time  in  the  early  phases  of  the  acquisition  process. 

The  model  is  based  primarily  on  the  post-landing  vehicle  recovery  process  for  the  only  reusable  space  vehicle  in  the  world,  the 
Space  Shuttle  Orbiter.  However,  it  does  contain  some  elements  from  the  aircraft  recovery  process  for  the  F-16  fighter  aircraft.  The 
model  was  analyzed  and  validated  by  a  panel  of  experts  in  the  fields  of  Space  Shuttle  Orbiter  and  F-16  aircraft  post-landing  recovery. 
The  model  was  verified  using  an  assertion  checking  method.  In  addition  to  the  model,  conclusions  are  drawn  regarding  several  design 
decision  based  on  a  comparison  of  the  Space  Shuttle  orbiter  and  F-16  post-landing  recovery  operations.  No  experiments  to  evaluate 
design  alternatives  were  conducted  as  a  part  of  this  research. 


15.  SUBJECT  TERMS 

Reusable  Military  Launch  Vehicle,  RMLV,  Discrete -Event  Simulation,  Delphi  process.  Space  Shuttle  Orbiter, 
Post-Landing  Recovery,  Spacelift,  Operationally  Responsive  Space 


16.  SECURITY  CLASSIFICATION  OF: 


17.  LIMITATION  OF 
ABSTRACT 


18.  NUMBER 
OF 

PAGES 


19a.  NAME  OF  RESPONSIBLE  PERSON 

Alan  Johnson,  PhD.  (ENS) 

19b.  TELEPHONE  NUMBER  (Include  area  code) 
(937)  255-6565,  ext  4314;  e-mail:  alan.johnson@afit.edu 


73 


Standard  Form  298  (Rev.  8-98) 

Prescribed  by  ANSI  Std.  Z39-18 


74 


